Re: #612: 9.2.2 requirements

+1 on everything Patrick has said. Removing 9.2.2 just brings us back to
the same old (pretty nasty) TLS situation we have now, and just because
it might be hard doesn't mean we shouldn't do the right thing in pushing
the bar higher.


On Mon, Oct 27, 2014, at 18:39, Patrick McManus wrote:
>
> On Mon, Oct 27, 2014 at 4:54 PM, Mark Nottingham
> <mnot@mnot.net> wrote:
>> Thoughts?
>
> poodle is direct evidence that algorithms that are necessary for
> interop simply don't get deprecated in the field even when they are
> superceded.. Requiring current best practices at least makes a clean
> break for h2 which doesn't have the interop baggage. Half measures are
> an un-necessarily weak effort.
>
> This is exacerbated by the previous decision to move from NPN to ALPN
> - a client interested in restricting h2 to newer security suites can
> no longer effectively do so as the server is allowed to choose old
> (perhaps h1 suitable suites) along with h2. That problem would not be
> symmetrical for a server with NPN wishing to enforce a higher level of
> security as it still selects the cipher suite. Brian provided
> convincing reasoning previously on why a peer would want to do so.
>
> we can do better.
>
>
>
>

--
Peace, -Nick