Viktor Dukhovni wrote: > On Thu, Aug 06, 2015 at 09:13:53AM +0200, Sven Schwedas wrote: >> Why medium and not high, while we're at it? What clients would have >> problems with it? > > Because cleartext is not stronger than medium. If you make TLS > impossible for peers that only support medium, they'll do cleartext. > Raising the floor too high lowers security. Security is improved > by raising the ceiling (stronger best supported ciphers), not > raising the floor (removing weak ciphers that are still best > available for a non-negligible set of peers).
Viktor, I have some doubts regarding your point of view on this: I suspect that many admins maintaining systems only capable using medium ciphers simply look whether their system uses STARTTLS or not and won't check which particular ciphers are used. IMO it might be a good learning effect for them if you disable STARTTLS for them. => drop RC4 Ciao, Michael.
smime.p7s
Description: S/MIME Cryptographic Signature
