News for hackers. Stuff that matters.

A comment on Proposal to Change the Default TLS Ciphersuites Offered by Browsers. Parent comment

Re:Proposal to Change the Default TLS Ciphersuites Offered b... by tptacek on Sunday September 08, 2013 @02:25PM (#6349663)
The only thing you want not to happen is for software to start generating and negotiating its own curves, because that then requires all interoperable implementations to parse and validate random curves from attackers.
[ Parent | on HN ]
Re:Proposal to Change the Default TLS Ciphersuites Offered b... by cryptbe on Sunday September 08, 2013 @05:43PM (#6350494)
No, I didn't say that everyone generates their own curves. I meant the security community should generate our own curves. Somebody should email Thomas Pornin.
[ Parent | on HN ]
Re:Proposal to Change the Default TLS Ciphersuites Offered b... by pbsd on Sunday September 08, 2013 @06:12PM (#6350627)
There are already several alternative curve sets, satisfying various degrees of paranoia:

- http://certivox.org/display/EXT/CertiVox+Standard+Curves

- http://tools.ietf.org/html/rfc5639

- curve25519 and the other djb et al curves.

[ Parent | on HN ]
Re:Proposal to Change the Default TLS Ciphersuites Offered b... by tptacek on Sunday September 08, 2013 @05:53PM (#6350527)
Sorry, I didn't mean to imply you were saying that.
[ Parent | on HN ]