2 ms·
> Meanwhile, configurable "cipher schemes" have in practice been a disaster. They are, for instance, the reason we still have RC4 in TLS today, despite knowing
by Shish2k 9y ago
> Meanwhile, configurable "cipher schemes" have in practice been a disaster. They are, for instance, the reason we still have RC4 in TLS today, despite knowing for almost 2 decades now that RC4 is broken.
If TLS had hard-coded RC4 with no alternatives, how would we be better off?
- tptacek 9y agoYou have one cipher, deployed in exactly one authenticated encryption construction. The protocol has a version. If the cipher is weakened or broken, you upgrade the whole protocol. You don't add better ciphersuites to the existing protocol to compensate. Having a bunch of ciphersuites, all believed at the time of their inclusion to be strong, just maximizes the attack surface of the protocol. Having ciphersuite negotiation at all practically guarantees that interoperability will require lowest-common-denominator security.