[Git][NTPsec/ntpsec][master] 6 commits: nts.adoc: Capitalize a MUST

[Gary E. Miller]

Yo Richard!

On Fri, 8 Feb 2019 15:01:37 -0600
Richard Laager via devel <devel at ntpsec.org> wrote:

> >> dc2827a3 by Richard Laager at 2019-02-07T18:42:59Z
> >> nts.adoc: Make AEAD_AES_SIV_CMAC_256 not implicit
> >>
> >> If the user specifies a NTPCipherSuite string, they need to include
> >> AEAD_AES_SIV_CMAC_256 if they want it.  Otherwise, if it is
> >> implicit, as the document previous said, this would preclude the
> >> user from disabling AEAD_AES_SIV_CMAC_256 in the future, should
> >> that become necessary.  
> > 
> > The traditional way that OpenSSL, and its users (Apache, nginx,
> > postfix, sendmail, etc.) hand this is with the "!" operator.  
> 
> I'm aware of the ! operator in OpenSSL cipher strings.

I assumed you did.

> The point of my edit was to replace text which violated the usual
> conventions. The previous text was saying that whatever you specified
> would have AEAD_AES_SIV_CMAC_256 added onto it.

Yup, I 100% agree.

> For example,
> "AEAD_AES_GCM_256" would actually mean
> "AEAD_AES_GCM_256:AEAD_AES_SIV_CMAC_256" (or
> "AEAD_AES_SIV_CMAC_256:AEAD_AES_GCM_256", that part wasn't clear).
> That is definitely not how cipher strings normally work, and is
> undesirable.

Yup, I 100% agree.

> In fact, even with the ! operator, if the client is
> going to add ciphers *after* processing the cipher string, that's not
> going to work.

Yup, I 100% agree.

My point is that instead of coming up with somthing new,we should try
hard to stick to longstanding and well battle tested existing cipher
strings.

RGDS
GARY
---------------------------------------------------------------------------
Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703
	gem at rellim.com  Tel:+1 541 382 8588

	    Veritas liberabit vos. -- Quid est veritas?
    "If you can’t measure it, you can’t improve it." - Lord Kelvin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 851 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ntpsec.org/pipermail/devel/attachments/20190208/c0a74fc8/attachment.bin>