Bug#907518: [RFC] Disable TLSv1.0 by default, but allow enabling it

2019-01-05 Thread Jouni Malinen
On Tue, Dec 04, 2018 at 01:00:08PM +0100, Andrej Shadura wrote: > In the Debian bug reports #907518 and #911297 (see below), people complained > that OpenSSL 1.1.1 disables TLSv1.0 and some other insecure settings by > default, but some older networks may still require their support: > wpa_supp

Bug#907518: [RFC] Disable TLSv1.0 by default, but allow enabling it

2018-12-15 Thread Eugen Dedu
On 05/12/2018 09:52, Andrej Shadura wrote: Hardcode a minimal version just for wpa-supplicant to TLSv1.0? What about ciphers? Anything else? Hi, In order to make it work with eduroam I have to change in ciphers too like this: MinProtocol = TLSv1.2 -> 1 CipherString = DEFAULT@SECLEVEL=2 ->

Bug#907518: [RFC] Disable TLSv1.0 by default, but allow enabling it

2018-12-12 Thread Michelle Sullivan
Alan DeKok wrote: On Dec 12, 2018, at 3:48 PM, Andrej Shadura wrote: On 05/12/2018 09:52, Andrej Shadura wrote: On 05/12/2018 00:09, Jouni Malinen wrote: Right, so what would you recommend for me to do in the meanwhile? Hardcode a minimal version just for wpa-supplicant to TLSv1.0? What about

Bug#907518: [RFC] Disable TLSv1.0 by default, but allow enabling it

2018-12-12 Thread Alan DeKok
On Dec 12, 2018, at 3:48 PM, Andrej Shadura wrote: > > On 05/12/2018 09:52, Andrej Shadura wrote: >> On 05/12/2018 00:09, Jouni Malinen wrote: >> Right, so what would you recommend for me to do in the meanwhile? >> Hardcode a minimal version just for wpa-supplicant to TLSv1.0? What >> about ciph

Bug#907518: [RFC] Disable TLSv1.0 by default, but allow enabling it

2018-12-12 Thread Andrej Shadura
On 05/12/2018 09:52, Andrej Shadura wrote: > On 05/12/2018 00:09, Jouni Malinen wrote: > Right, so what would you recommend for me to do in the meanwhile? > Hardcode a minimal version just for wpa-supplicant to TLSv1.0? What > about ciphers? Anything else? I would really appreciate some opinion fr

Bug#907518: [RFC] Disable TLSv1.0 by default, but allow enabling it

2018-12-05 Thread Andrej Shadura
On 05/12/2018 00:09, Jouni Malinen wrote: > On Tue, Dec 04, 2018 at 01:00:08PM +0100, Andrej Shadura wrote: >> This patch is not intended to be merged into the upstream code, but I >> would still like to receive comments from people involved in development. >> >> In the Debian bug reports #907518 a

Bug#907518: [RFC] Disable TLSv1.0 by default, but allow enabling it

2018-12-04 Thread Jouni Malinen
On Tue, Dec 04, 2018 at 01:00:08PM +0100, Andrej Shadura wrote: > This patch is not intended to be merged into the upstream code, but I > would still like to receive comments from people involved in development. > > In the Debian bug reports #907518 and #911297 (see below), people complained > tha