TLS/SSL robustness - high, medium, low

A thought is to add another robustness section to define TLS/SSL
robustness
 
Robustness of information assurance provided by TLS/SSL is dependant on
the version of the protocol and strength of ciphers used. User agents
and web servers should have the ability to restrict the use of TLS/SSL
to require latest version of the TLS/SSL protocol and configuration
settings should provide the capability to choose with fine grained
precision the cipher suites allowed. Cipher suites are arranged to note
export/weak (?? or key settings / 40-56 bit ciphers), medium (?? ./ 128
bit ciphers) and strong (?? / 256 bit ciphers). 
 
High Robustness
Requires the use of latest version of the TLS/SSL protocol and
connections must use cipher suites that fit into the strong category. 
 
Medium Robustness
Use of TLS/SSL protocol that is 1 version behind the latest TLS/SSL
definition and uses ciphers in medium or strong category
 
Low Robustness
Use of a TLS/SSL protocol and cipher settings that do not fit into
medium or high robustness categories. 
 
or something like this
 
Bill D.
 
 
 

	 

Received on Tuesday, 8 January 2008 17:51:57 UTC