Re: [Ach] Proposal to Remove legacy TLS Ciphersuits Offered by Firefox

2014-01-05 Thread cloos
Julien Vehent writes: > I would argue that our documents target server configurations, where > AES-NI is now a standard. It is not. Many sites run on virtuals, often using kvm. And most kvm sites provide a QEMU Virtual CPU which only supports sse2. And even without kvm, there is still a /lot/

Re: [Ach] Proposal to Remove legacy TLS Ciphersuits Offered by Firefox

2014-01-05 Thread ianG
On 5/01/14 18:27 PM, Kurt Roeckx wrote: On Fri, Jan 03, 2014 at 12:19:10AM +0100, Aaron Zauner wrote: 3DES isn't broken. Triple DES provides about 112bit security (We've a section on the topic in the Paper in the Keylenghts section). All ciphers that we recomend are at least at 128bit securi

Re: [Ach] Proposal to Remove legacy TLS Ciphersuits Offered by Firefox

2014-01-05 Thread Kurt Roeckx
On Fri, Jan 03, 2014 at 12:19:10AM +0100, Aaron Zauner wrote: > > > 3DES isn't broken. > Triple DES provides about 112bit security (We've a section on the topic in > the Paper in the Keylenghts section). All ciphers that we > recomend are at least at 128bit security. The document doesn't seem to