Andrew Cooke <[EMAIL PROTECTED]>wrote:
>> Although my post, in retrospect sounded like eay is some kind of font of
>> eternal knowledge, I meant just that since he wrote the thing, he could
>> explain the design decisions.
>>
>> Anyway, I've now found the following two posts which shed light on the
>> historic basis for support (or not) of DH:
>>
>> http://remus.prakinf.tu-ilmenau.de/ssl-users/archive25/0085.html
>> http://remus.prakinf.tu-ilmenau.de/ssl-users/archive19/0160.html
Dr Stephen Henson <[EMAIL PROTECTED]> replied:
>I can vaguely recall seeing that at the time.
>
>We can get equivalent "protection" by not enabling anon DH unless it is
>specifically included in the cipher list: still disallowing it when a
>user has declared some knowledge of it by explicitly stating they want
>it is IMHO plain silly.
Eric is off in the wilds of Tasmania (really;-) until after the
holidays, but I don't think he would disagree. With Anon DH -- as in a
number of other situations (like NULL ciphers) -- Eric wrote the code into
SSLeay, but he was really worried about dangerous architectural
configurations (with ADH, vulnerability to MitM attacks), so he forced
anyone who wanted to access that logic to recompile SSLeay with an extra
define.
An EAY test for cluefulness. Programmer's perogative, perhaps;-)
Without some alternative mode of server authentication, of course,
Anon DH remains a pretty scary proposition -- all the more so because it
implies a level of trustworthiness that it can not provide.
>The DH referred to in the other message is PKCS#3 DH which, whereas the
>only DH certificates are now X9.42 and still only present AFAIK in the
>S/MIME v3 examples group. X9.42 solves some of the problems of PKCS#3
>in certificates but it is still awkward. X9.42 DH didn't exist at the time
>of the message.
>
>The honouring of X509v3 usage extensions BTW: I partially added that a
>few weeks ago to the development release.
Suerte,
_Vin
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
