Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on Patch Critical Cryptographic Vulnerability in Microsoft Windows [pdf]. Parent comment
So say: TLS 1.4 = “NIST version” only supports ECDHE(P-256)+AES-256-GCM+SHA256 TLS 1.5 = “Bernstein Version” only supports ECDHE(X25519)+ChaCha20-Poly1305+Blake2b
Because of the X.509 legacy both these future TLS might have to support RSA-2048 and P-256 ECC certs, but supporting just one would be better.
In either case fewer options and branches is simpler and more secure. Both can be enabled, one turned off if a weakness is found.
There are no comments on this comment yet.
So say: TLS 1.4 = “NIST version” only supports ECDHE(P-256)+AES-256-GCM+SHA256 TLS 1.5 = “Bernstein Version” only supports ECDHE(X25519)+ChaCha20-Poly1305+Blake2b
Because of the X.509 legacy both these future TLS might have to support RSA-2048 and P-256 ECC certs, but supporting just one would be better.
In either case fewer options and branches is simpler and more secure. Both can be enabled, one turned off if a weakness is found.