Yo Richard! On Fri, 8 Feb 2019 15:01:37 -0600 Richard Laager via devel <devel@ntpsec.org> wrote:
> >> dc2827a3 by Richard Laager at 2019-02-07T18:42:59Z
> >> nts.adoc: Make AEAD_AES_SIV_CMAC_256 not implicit
> >>
> >> If the user specifies a NTPCipherSuite string, they need to include
> >> AEAD_AES_SIV_CMAC_256 if they want it. Otherwise, if it is
> >> implicit, as the document previous said, this would preclude the
> >> user from disabling AEAD_AES_SIV_CMAC_256 in the future, should
> >> that become necessary.
> >
> > The traditional way that OpenSSL, and its users (Apache, nginx,
> > postfix, sendmail, etc.) hand this is with the "!" operator.
>
> I'm aware of the ! operator in OpenSSL cipher strings.
I assumed you did.
> The point of my edit was to replace text which violated the usual
> conventions. The previous text was saying that whatever you specified
> would have AEAD_AES_SIV_CMAC_256 added onto it.
Yup, I 100% agree.
> For example,
> "AEAD_AES_GCM_256" would actually mean
> "AEAD_AES_GCM_256:AEAD_AES_SIV_CMAC_256" (or
> "AEAD_AES_SIV_CMAC_256:AEAD_AES_GCM_256", that part wasn't clear).
> That is definitely not how cipher strings normally work, and is
> undesirable.
Yup, I 100% agree.
> In fact, even with the ! operator, if the client is
> going to add ciphers *after* processing the cipher string, that's not
> going to work.
Yup, I 100% agree.
My point is that instead of coming up with somthing new,we should try
hard to stick to longstanding and well battle tested existing cipher
strings.
RGDS
GARY
---------------------------------------------------------------------------
Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703
g...@rellim.com Tel:+1 541 382 8588
Veritas liberabit vos. -- Quid est veritas?
"If you can’t measure it, you can’t improve it." - Lord Kelvin
pgpEi5ur4kYY_.pgp
Description: OpenPGP digital signature
_______________________________________________ devel mailing list devel@ntpsec.org http://lists.ntpsec.org/mailman/listinfo/devel
