2 ms·
I suppose you're right. The timeline avoids editorializing but at the same time tries to inform, and in my opinion it would be valuable to inform that from Marc
by niftich 10y ago
I suppose you're right. The timeline avoids editorializing but at the same time tries to inform, and in my opinion it would be valuable to inform that from March 2013 until Chrome shipped TLSv1.2 in August 2013, there was no good cipher to pick that didn't have an exploit.
As it stands now you have to combine different pieces of information, some already included in the timeline (RC4, Lucky 13, Chrome TLSv1.2), some you have to know by knowing what's in TLSv1.1 and what's not (yet) in it.
- tptacek 10y agoI also don't think it's a great idea to open up the can of worms about whether "no viable TLS ciphersuites" began with Lucky 13 or with RC4 (which depends on whether you think the most recent RC4 paper was the death knell for RC4, or whether the Fluhrer-McGrew biases were).