4 ms·
If you control both the client and server, then yeah, you can use whatever protocol you want. Doesn't even need to be TLS, you could roll your own thing. But i
by 10000truths 2mo ago
If you control both the client and server, then yeah, you can use whatever protocol you want. Doesn't even need to be TLS, you could roll your own thing.
But if you only control one of the endpoints, then your ability to connect to a peer depends on what the peer thinks. And if the peer follows a standard that says your offered ciphersuites are all insecure, then you're out of luck.
- magicalhippo 2mo ago> And if the peer follows a standard that says your offered ciphersuites are all insecure, then you're out of luck. Not even that. Many peers disconnect you if you offer any insecure cipher suite, in order to avoid downgrade attacks[1] presumably. So if such a peer is updated to match this RFC, you'll have to follow the RFC too if you want to talk to them. [1]: https://en.wikipedia.org/wiki/Downgrade_attack https://en.wikipedia.org/wiki/Downgrade_attack