From: cinap_lenrek@felloff.net
To: 9front@9front.org
Subject: Re: [9front] [patch] devtls updates
Date: Mon, 31 May 2021 13:45:37 +0200 [thread overview]
Message-ID: <A79668CE9786A33A514E6CDCE6B848E2@felloff.net> (raw)
In-Reply-To: <CA52C64787183A612538F6AF9EEB9D6E@fulton.software>
that patch is stupid.
who the hell uses sha512 as a digest? do not add more of this crap, it is OVER.
the issue with the cipher+digest construction was that the padding schemes
and the order of encryption and authentication turned out to have issues.
modern tls cipher suits use aead ciphers where authentication and encryption are
done together and the whole construction has been validated as a whole.
such as: chacha20-poly1305 and aes-gcm.
which we all support and it will get negotiated when avalable over the classic
cypher+digest tls suits.
adding more digest algorithms in devtls doesnt do anything. what matters is what
tlshand.c negotiates and it has a curated list of cipher suits. in the end
the server has the final say what cipher is picked.
and in comparsion to mozilla we never had these downgrade attack issues
because we did not just reconnect and try with a older version.
--
cinap
next prev parent reply other threads:[~2021-05-31 11:54 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-30 15:05 fulton
2021-05-31 0:03 ` Lyndon Nerenberg (VE7TFX/VE6BBM)
2021-05-31 15:37 ` ori
2021-05-31 22:46 ` Lyndon Nerenberg (VE7TFX/VE6BBM)
2021-06-02 0:38 ` ori
2021-06-02 4:30 ` Lyndon Nerenberg (VE7TFX/VE6BBM)
2021-05-31 11:45 ` cinap_lenrek [this message]
2021-05-31 16:16 ` fulton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=A79668CE9786A33A514E6CDCE6B848E2@felloff.net \
--to=cinap_lenrek@felloff.net \
--cc=9front@9front.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).