Re: [Ach] Proposal to Remove legacy TLS Ciphersuits Offered by Firefox

2014-01-05 Thread Kurt Roeckx
On Fri, Jan 03, 2014 at 12:19:10AM +0100, Aaron Zauner wrote: 3DES isn't broken. Triple DES provides about 112bit security (We've a section on the topic in the Paper in the Keylenghts section). All ciphers that we recomend are at least at 128bit security. The document doesn't seem to say

Re: [Ach] Proposal to Remove legacy TLS Ciphersuits Offered by Firefox

2014-01-05 Thread ianG
On 5/01/14 18:27 PM, Kurt Roeckx wrote: On Fri, Jan 03, 2014 at 12:19:10AM +0100, Aaron Zauner wrote: 3DES isn't broken. Triple DES provides about 112bit security (We've a section on the topic in the Paper in the Keylenghts section). All ciphers that we recomend are at least at 128bit

Re: [Ach] Proposal to Remove legacy TLS Ciphersuits Offered by Firefox

2014-01-05 Thread cloos
Julien Vehent jul...@linuxwall.info writes: I would argue that our documents target server configurations, where AES-NI is now a standard. It is not. Many sites run on virtuals, often using kvm. And most kvm sites provide a QEMU Virtual CPU which only supports sse2. And even without kvm,