Re: #612: 9.2.2 requirements

On 31 October 2014 15:52, Brian Smith <brian@briansmith.org> wrote:
> The TLS implementation should be configured to always prefer 9.2.2-compliant
> cipher suites over non-9.2.2 compliant cipher suites, regardless of which
> application protocol is negotiated. Or, at least that should be the case
> when the TLS implementation doesn't offer a mechanism to choose the cipher
> suite based on the application protocol.

You only have to ensure that 9.2.2-compliant suites are preferred up
until the MTI suite, so it's not even that hard.

As it happens, the order you chose for the suites in NSS places that
second (the first is the same with an ECDSA cert - less widely
deployed, but faster and more secure generally).  After that, the
order doesn't matter much.

Received on Saturday, 1 November 2014 02:11:30 UTC