Hi! On Thu, Apr 04, 2019 at 11:06:07PM +0200, Frank Ueberschar wrote: > Here > https://docs.fedoraproject.org/en-US/packaging-guidelines/CryptoPolicies/ is > a proposal to use a specific cipher list string for > SSL_CTX_set_cipher_list(): "PROFILE=SYSTEM". > > Especially this citation: "if that call is present and provided a fixed > string which does not contain PSK or SRP, replace the string with > "PROFILE=SYSTEM", or remove the call" > > We have to rely on PSK. What ist the reason behind the above advice? The crypto policy does not cover those two options currently. The part covering GnuTLS applications seems to be more informative: "If it contains PSK or SRP do nothing (these applications are not currently covered by the default policy)" So I'd say you're good about using PSK. My guesses about why this is set like it is: The reasoning seems to be something like "Don't force applications to use a specific set of Cipher/MAC/Signature Algorithm/Key Exchange methods, if there are multiple interchangeable options." By setting this to PROFILE=SYSTEM as default you allow the system administrator to disable specific ciphers for all applications. (e.g. disable 3DES-CBC system-wide) If you've got PSK or SRP in the string I'd say it is quite likely that it's not possible to switch to something else without rewriting parts of the application, so there is nothing left to disable system-wide anyway. All the best, David
Attachment:
signature.asc
Description: PGP signature
_______________________________________________ security mailing list -- security@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to security-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/security@xxxxxxxxxxxxxxxxxxxxxxx
