7 ms·

I'm not a fan of explicitly listing cipher names: when new ciphers are added you have to revise your list again, etc. I very much prefer the simplistic approac

I'm not a fan of explicitly listing cipher names: when new ciphers are added you have to revise your list again, etc. I very much prefer the simplistic approach taken by OpenSMTPD: http://www.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/smtpd/ssl.h?rev=1.7 http://www.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/smtpd/ssl... #define SSL_CIPHERS "HIGH:!aNULL:!MD5"

throwaway7767 12y ago
It really bothers me that 3DES is counted in the HIGH set in OpenSSL. The HIGH set, in my mind, should include only strong ciphers that would make sense to deploy in a new product today. Otherwise, I would love to just say to the crypto library, "give me strong ciphers only".
- kjs3 12y ago
  In what sense is 3DES not strong?
  - edwintorok 12y ago
    Its security strength is less than 2^128, doesn't mean its completely broken but there are better alternatives: https://en.wikipedia.org/wiki/Triple_DES#Security https://en.wikipedia.org/wiki/Triple_DES#Security