Re: Forward secrecy

2013-12-23 Thread nanotek
On 24/12/2013 3:19 AM, Viktor Dukhovni wrote: On Tue, Dec 24, 2013 at 03:00:37AM +1100, nanotek wrote: We obviously don't know which is stronger against hypothetical unpublished attacks, EDH at 2048-bits or the P-256 curve. Feel free to roll the dice. Against publically known attacks

RE: Forward secrecy (was: Certificate Error)

2013-12-23 Thread nanotek
On 24/12/2013 2:09 AM, Viktor Dukhovni wrote: On Tue, Dec 24, 2013 at 01:29:38AM +1100, nanotek wrote: Still, might be a good time to create my own CA and upgrade to 4096 bit keys/certificates You can deploy 4096-bit RSA key if it makes you feel more cool, but there is little point in going

Re: Forward secrecy

2013-12-23 Thread nanotek
On 24/12/2013 1:40 AM, Wietse Venema wrote: nanotek: Still, might be a good time to create my own CA and upgrade to 4096 bit keys/certificates using SHA512 algorithms and make use of some Diffie-Hellman ephemeral elliptic curve parameters for perfect forward secrecy. I've read

Re: Certificate Error (android client)

2013-12-23 Thread nanotek
Original Message Date: Tuesday, December 24, 2013 12:57:53 AM +1100 From: nanotek To: postfix-users@postfix.org Subject: Certificate Error (android client) I am receiving a "Certificate Error" when sending mail from K-9 on my android. I do not receive an

Certificate Error (android client)

2013-12-23 Thread nanotek
I am receiving a "Certificate Error" when sending mail from K-9 on my android. I do not receive any error on my PC client (Thunderbird). I only have a self-signed public certificate and private key configured for use by Postfix. Should I create my own Certificate Authority and cat its certific