Re: [TLS] Status of IDEA and single-DES (ticket #64)

[Hovav Shacham <hovav@xxxxxxxxx>]

On Jan 22, 2008, at 12:41 AM, <Pasi.Eronen@xxxxxxxxx> wrote:

> (1) Remove all mentions of IDEA and single-DES from the TLS 1.2
> main specification. Create a separate (1-page) document which lists
> the cipher suite numbers, along with some kind of "not really that
> good idea usually" advice.

(1) is my preference out of the two options here.

Cheers --
Hovav.


PS:

> Several people have supported simple "MUST NOT";
> others have argued that this is a policy decision, and should not
> be hardcoded in the spec.

I happen to think that the TLS spec is exactly where policy that has  
security implications should be hardcoded.  Any other approach is  
inviting insecurity.


_______________________________________________
TLS mailing list
TLS@xxxxxxxxxxxxxx
https://www1.ietf.org/mailman/listinfo/tls