Re: Chrome: From NSS to OpenSSL

2014-02-03 Thread Alan Braggins
On 31/01/14 18:28, Ryan Sleevi wrote: On Fri, January 31, 2014 9:18 am, Alan Braggins wrote: On 31/01/14 10:24, Julien Pierre wrote: On 1/27/2014 10:28, Kathleen Wilson wrote: Draft Design Doc posted by Ryan Sleevi regarding Chrome migrating from NSS to OpenSSL:

Re: Chrome: From NSS to OpenSSL

2014-02-03 Thread David Woodhouse
On Mon, 2014-02-03 at 12:13 +, Alan Braggins wrote: Having support for PKCS#11 tokens at all is a pro, even if one irrelevant to the vast majority of users. That gets less true as we start to use PKCS#11 a little more. It isn't *just* about hardware tokens — things like gnome-keyring

Re: Proposal to Remove legacy TLS Ciphersuits Offered by Firefox

2014-02-03 Thread florian . bender
Hi folks, there is consensus that some algorithms/ciphers (e.g. RC4) allowed by default should not be considered secure, though because of interop issues, they cannot be removed at this point. The problem with this is that people may think they are using a secure connection while in fact,

Re: Chrome: From NSS to OpenSSL

2014-02-03 Thread Ryan Sleevi
On Mon, February 3, 2014 4:30 am, David Woodhouse wrote: On Mon, 2014-02-03 at 12:13 +, Alan Braggins wrote: Having support for PKCS#11 tokens at all is a pro, even if one irrelevant to the vast majority of users. That gets less true as we start to use PKCS#11 a little more. It

Re: Proposal to Remove legacy TLS Ciphersuits Offered by Firefox

2014-02-03 Thread Chris Newman
As a non-Firefox/non-HTTP consumer of NSS, I'd like to see an NSS API flag indicating a cipher suite is retained for backwards compatibility but considered inferior by cryptographic community standards at the time the NSS library was built. A. is unacceptable because it breaks copy/paste of