That section only applies to ciphers that don't already incorporate
authenticity with their own internal MAC; thus if your server only
supports authenticated encryption ciphers, there is no benefit in
touching that section.

You can simply define the ciphers used to be a non-empty combination of
[email protected], [email protected], and
[email protected].

The downside of hardcoding the ciphers though is that eventually there
will be better ciphers; and unless you stay on top of it, you will
prevent yourself from using new ciphers that are added. If you're
worried about that, then you can simply remove all the ciphers sans
the ones listed. Due to how easy it is to mess things up when one
separates encryption and authentication (e.g., MAC-then-encrypt), I
posit that new ciphers will continue with the practice of incorporating
their own authenticity algorithm; thus such ciphers would still not be
affected by the MACs section.

Reply via email to