On Thu, Dec 4, 2014 at 11:53 AM, Eric H. Christensen <sparks@xxxxxxxxxxxxxxxxx> wrote: > There will always be a default and that default should be something sane that both provides protection and compatibility. The current default leaves something to be desired with respect to security. Using the recommendations provided by Mozilla you get both in a balanced way. I could see the three recommended cipher suites lists being used as a low, default, and high security ratings within the CryptoPolicy. I'm not a fan of specifying individual cipher suites. OpenSSL accepts a wide variety of formats in regards to setting the cipher preference. Specifying individual components such as the digest or algorithm is cleaner in my opinion. The following is from Qualys, "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4". This provides a close equivalent to the Mozilla "modern" recommendation. Adjustments to this preference for older browsers would require adjustments permitting the use of weak algorithms (RC4 and 3DES) and older message digests (SHA-1). Brandon Vincent -- security mailing list security@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/security
