Subject: [Uta] Fwd: [cryptography] Better Crypto

From: Stephen Farrell <[email-masked]>
Date: Sun, 05 Jan 2014 10:05:36 +0000

This looks useful. Be good if there's overlap  between this list and the bettercrypto.org one - is there? 

S

-------- Original Message --------
From: ianG <[email-masked]>
Sent: Sun Jan 05 07:59:41 GMT+00:00 2014
To: Crypto discussion list <[email-masked]>
Subject: [cryptography] Better Crypto

Not sure if it has been mentioned here.  The Better Crypto group at 
bettercrypto.org have written a (draft) paper for many of those likely 
configurations for net tools. The PDF is here:

https://bettercrypto.org/static/applied-crypto-hardening.pdf

If you're a busy sysadm with dozens of tools to fix, this might be the 
guide for you.

iang
_______________________________________________
cryptography mailing list
[email-masked]
http://lists.randombit.net/mailman/listinfo/cryptography

---

From: Leif Johansson <[email-masked]>
Date: Sun, 05 Jan 2014 11:35:54 +0100

> This looks useful. Be good if there's overlap  between this list and the bettercrypto.org one - is there? 
They seem to be pushing camellia?

Anyone on this list involved with bettercrypto.org?
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 05 Jan 2014 10:41:35 +0000

> They seem to be pushing camellia?

Yeah, that looked odd. OTOH, Camellia turns up often on real
sites, not sure if that's thoughtful or just because others
have done it. (I don't recall the details but there was a
browser or server bug that used cause Camellia to be used
a lot, but I thought that had been fixed.)

> Anyone on this list involved with bettercrypto.org?

Be good if there were. I'm not.

S.

---

From: Ilari Liusvaara <[email-masked]>
Date: Sun, 5 Jan 2014 16:40:00 +0200

> a lot, but I thought that had been fixed.)

Are you referring to the Firefox quirk of sending Camelia before
AES in ciphersuite list? That made lots of servers pick Camelia
instead of AES when both were supported...

-Ilari

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 05 Jan 2014 15:22:37 +0000

> instead of AES when both were supported...

Sounds like it, but like I say I forget the details.
And they don't matter that much really - it'd be good
if the BCPs developed here and the work being done
by those other folks are consistent, but they don't
need to be identical.

S.

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 5 Jan 2014 11:46:18 -0800

> This looks useful. Be good if there's overlap  between this list and the bettercrypto.org one - is there? 

So does the follow-up from Peter Gutmann, which savages the choices.

--Paul Hoffman

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 05 Jan 2014 19:55:28 +0000

> So does the follow-up from Peter Gutmann, which savages the choices.

Savages is overstated. Even for Peter, for whom savaging is
the normal modus-operandi:-) (Apologies Peter if you're here,
couldn't resist.)

Point is these people have done work on which implementations
support what and what can be configured in various of 'em. And
that's useful. And there's nothing to stop this wise set of
folks suggesting better ciphersuites to them as well.

S.

---

From: Leif Johansson <[email-masked]>
Date: Sun, 05 Jan 2014 22:21:35 +0100

> by those other folks are consistent, but they don't
I did a tweet reach-out to them.. Lets see what happens next.

        Cheers Leif

---

From: Leif Johansson <[email-masked]>
Date: Sun, 05 Jan 2014 22:22:42 +0100

> folks suggesting better ciphersuites to them as well.
Precisely.

---

From: Yan Zhu <[email-masked]>
Date: Sun, 05 Jan 2014 19:17:18 -0800

> Anyone on this list involved with bettercrypto.org?

Not directly, but one of the authors asked me to review a draft of the
guide a couple weeks ago. I suggested not mentioning ARIA or FORTEZZA
and instead putting in a word for Salsa20 and ChaCha.

>> S
>> 
>> -------- Original Message -------- From: ianG <[email-masked]> 
>> Sent: Sun Jan 05 07:59:41 GMT+00:00 2014 To: Crypto discussion
>> list <[email-masked]> Subject: [cryptography] Better
>> Crypto
>> 
>> Not sure if it has been mentioned here.  The Better Crypto group
>> at bettercrypto.org have written a (draft) paper for many of
>> those likely configurations for net tools. The PDF is here:
>> 
>> If you're a busy sysadm with dozens of tools to fix, this might
>> be the guide for you.
>> 
>> iang _______________________________________________ cryptography
>> mailing list [email-masked] 
>> _______________________________________________ Uta mailing list 
>> [email-masked] https://www.ietf.org/mailman/listinfo/uta
> 
> 
> _______________________________________________ Uta mailing list 
> [email-masked] https://www.ietf.org/mailman/listinfo/uta
> 

- -- 
Yan Zhu                           [email-masked]
Technologist                      Tel  +1 415 436 9333 x134
Electronic Frontier Foundation    Fax  +1 415 436 9993