News for hackers. Stuff that matters.

A comment on Patch Critical Cryptographic Vulnerability in Microsoft Windows [pdf]. Parent comment

Re:Patch Critical Cryptographic Vulnerability in Microsoft W... by quotemstr on Wednesday January 15, 2020 @09:08AM (#22054207)
How is that not cryptographic agility? Which cipher suites to support is a question separate from whether the cryptography should be runtime configurable at all.
[ Parent | on HN ]
Re:Patch Critical Cryptographic Vulnerability in Microsoft W... by tatersolid on Thursday January 16, 2020 @06:02PM (#22070026)
One should version whole protocols instead of adding option negotiation for things like cipher suite.

So say: TLS 1.4 = “NIST version” only supports ECDHE(P-256)+AES-256-GCM+SHA256 TLS 1.5 = “Bernstein Version” only supports ECDHE(X25519)+ChaCha20-Poly1305+Blake2b

Because of the X.509 legacy both these future TLS might have to support RSA-2048 and P-256 ECC certs, but supporting just one would be better.

In either case fewer options and branches is simpler and more secure. Both can be enabled, one turned off if a weakness is found.

[ Parent | on HN ]