3 ms·
What if all these "enterprise customers" are just black hats/the NSA trying to get weak cipher suites into TLS 1.3, because it opens up for cipher suite downgra
by runeks 9y ago
What if all these "enterprise customers" are just black hats/the NSA trying to get weak cipher suites into TLS 1.3, because it opens up for cipher suite downgrading attacks?
- wmf 9y agoNo one is proposing weak cipher suites (unless you're retroactively defining non-PFS as "weak").
- pdimitar 9y agoHis question still stands though, and I believe it's well-founded. There's no better place to weaken security efforts than the official committees. Enterprise stakeholders can drag a decision indefinitely and can make a lot of noise and eventually win at weakening the protocols, one way or another. (And I am afraid that they might other means to achieve what they want, but let's not go into the conspiracy theory territory.)