NTS client configuration support has landed

[Gary E. Miller]

Yo Richard!

On Fri, 1 Feb 2019 21:24:06 -0600
Richard Laager via devel <devel at ntpsec.org> wrote:

> On 2/1/19 9:07 PM, Richard Laager wrote:
> > On 2/1/19 7:56 PM, Gary E. Miller via devel wrote:  
> >> "tlsver [1.2 1.3]*  
> > If forcing a maximum version (e.g. for testing) is important, tlsver
> > seems like a good approach.  
> 
> Another approach would be to allow specifying a minimum and maximum
> version. That's what Firefox recently did, citing "We need policies
> for min/max TLS to be consistent Chrome and for the DOD STIG."
> 
> https://bugzilla.mozilla.org/show_bug.cgi?id=1522182

That could work.  I am used to how Apache, sendmail and postfix do
it, which is by using a plain list.

The problem is when the change from TLS to XXX, like the change from SSL
to TLS, which broke all the softeare using a min/max.

> So maybe that's a better way.

Flip a coin.

> I'm not familiar with DOD security policies, so I'm not able to find a
> reference either way as to whether a _maximum_ TLS version setting is
> required.

As a practical matter, in the current world where TLS 1.3 does not
really exist, a max of 1.2 makes sense.  Gonna be a long time before 1.3
works.

RGDS
GARY
---------------------------------------------------------------------------
Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703
	gem at rellim.com  Tel:+1 541 382 8588

	    Veritas liberabit vos. -- Quid est veritas?
    "If you can’t measure it, you can’t improve it." - Lord Kelvin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 851 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ntpsec.org/pipermail/devel/attachments/20190201/8d579a27/attachment.bin>