Removind dead code from NSS

2013-10-07 Thread Ludovic Hirlimann
Hi, AFAIK NSS still contains code for SSL2 , but no product uses it. SSL2 has been turned off at least 2 years ago. By removing SSL2 code we get : Smaller librarie faster compile time + test time What do you guys think ? Ludo -- dev-tech-crypto mailing list

Re: Removind dead code from NSS

2013-10-07 Thread Robert Relyea
On 10/04/2013 06:52 PM, Ludovic Hirlimann wrote: Hi, AFAIK NSS still contains code for SSL2 , but no product uses it. SSL2 has been turned off at least 2 years ago. By removing SSL2 code we get : Smaller librarie faster compile time + test time What do you guys think ? Ludo

Removing SSL 2.0 from NSS (was Re: Removing dead code from NSS)

2013-10-07 Thread Brian Smith
On Fri, Oct 4, 2013 at 6:52 PM, Ludovic Hirlimann ludovic+n...@mozilla.com wrote: Hi, AFAIK NSS still contains code for SSL2 , but no product uses it. SSL2 has been turned off at least 2 years ago. By removing SSL2 code we get : Smaller librarie faster compile time + test

Re: Proposal to Change the Default TLS Ciphersuites Offered by Browsers

2013-10-07 Thread Brian Smith
Mountie Lee moun...@paygate.net wrote: SEED was adopted to encourage escaping ActiveX dependency in Korea e-commerce environment. Many people at Mozilla, including us platform engineers, want this too. Our goal is to get rid of plugins on the internet completely. And, also, personally I think

Re: set default on for SHA2 for TLS1.1+ on firefox

2013-10-07 Thread Brian Smith
On Wed, Oct 2, 2013 at 2:28 AM, Mountie Lee moun...@paygate.net wrote: Hi. currently SHA2 hash algorithm is used in TLS1.1 and 1.2 mozilla firefox is supporting it now. Hi, Are you referring to the TLS_*_SHA256 cipher suites, or something else? I believe that we support SHA256-based

Re: Removing SSL 2.0 from NSS (was Re: Removing dead code from NSS)

2013-10-07 Thread Kurt Roeckx
On Mon, Oct 07, 2013 at 11:17:46AM -0700, Brian Smith wrote: On Fri, Oct 4, 2013 at 6:52 PM, Ludovic Hirlimann ludovic+n...@mozilla.com wrote: Hi, AFAIK NSS still contains code for SSL2 , but no product uses it. SSL2 has been turned off at least 2 years ago. By removing SSL2 code we get

Re: Proposal to Change the Default TLS Ciphersuites Offered by Browsers

2013-10-07 Thread Kurt Roeckx
On Fri, Aug 30, 2013 at 01:10:08AM +0200, Kurt Roeckx wrote: So what needs to happen so that we can move on with this? I still have the same question. Nothing seems to be happening. Kurt -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org

Re: Removing SSL 2.0 from NSS (was Re: Removing dead code from NSS)

2013-10-07 Thread Wan-Teh Chang
On Mon, Oct 7, 2013 at 11:17 AM, Brian Smith br...@briansmith.org wrote: I think it is likely that some vendors of NSS-based products with very conservative backward-compatibility guarantees, like Oracle and maybe Red Hat, may need to continue supporting SSL 2.0 in their products due to

Re: set default on for SHA2 for TLS1.1+ on firefox

2013-10-07 Thread Wan-Teh Chang
On Mon, Oct 7, 2013 at 12:02 PM, Brian Smith br...@briansmith.org wrote: If you are referring to something other than the TLS_*_SHA256 cipher suites, please be more specific as to what you are referring to. Brian, If you can enable TLS 1.2 by default in Firefox, that should make Mountie

Still possible to sign a certificate request with NSS tools?

2013-10-07 Thread Ivailo Kolev
Hallo, Thanks in advance for any help. I've builded NSS 3.15.2 in order to run a demo including certificate path validation. Looking at NSS docs https://developer.mozilla.org/en-US/docs/NSS/tools/NSS_Tools_certutil this should be possible. But it seems the code I eventually achieved has

Re: Removind dead code from NSS

2013-10-07 Thread Robert Relyea
On 10/07/2013 11:19 AM, Ryan Sleevi wrote: On Mon, October 7, 2013 11:07 am, Robert Relyea wrote: On 10/04/2013 06:52 PM, Ludovic Hirlimann wrote: Hi, AFAIK NSS still contains code for SSL2 , but no product uses it. SSL2 has been turned off at least 2 years ago. By removing SSL2 code we get

Re: Removing SSL 2.0 from NSS (was Re: Removing dead code from NSS)

2013-10-07 Thread Robert Relyea
On 10/07/2013 12:01 PM, Kurt Roeckx wrote: On Mon, Oct 07, 2013 at 11:17:46AM -0700, Brian Smith wrote: On Fri, Oct 4, 2013 at 6:52 PM, Ludovic Hirlimann ludovic+n...@mozilla.com wrote: Hi, AFAIK NSS still contains code for SSL2 , but no product uses it. SSL2 has been turned off at least 2

Re: Removing SSL 2.0 from NSS (was Re: Removing dead code from NSS)

2013-10-07 Thread Robert Relyea
On 10/07/2013 12:44 PM, Wan-Teh Chang wrote: On Mon, Oct 7, 2013 at 11:17 AM, Brian Smith br...@briansmith.org wrote: I think it is likely that some vendors of NSS-based products with very conservative backward-compatibility guarantees, like Oracle and maybe Red Hat, may need to continue

Re: Removing SSL 2.0 from NSS (was Re: Removing dead code from NSS)

2013-10-07 Thread Brian Smith
On Mon, Oct 7, 2013 at 3:20 PM, Robert Relyea rrel...@redhat.com wrote: On 10/07/2013 12:44 PM, Wan-Teh Chang wrote: On Mon, Oct 7, 2013 at 11:17 AM, Brian Smith br...@briansmith.org wrote: I think it is likely that some vendors of NSS-based products with very conservative

Re: Proposal to Change the Default TLS Ciphersuites Offered by Browsers

2013-10-07 Thread Brian Smith
On Thu, Sep 12, 2013 at 7:06 AM, Julien Vehent jul...@linuxwall.info wrote: It seems that AES-256 is always 25% to 30% slower than AES-128, regardless of AES-NI, or the CPU family. The slowest implementation of AES-256 has a bandwidth of 21MBytes/s, which is probably fast enough for any

Re: Proposal to Change the Default TLS Ciphersuites Offered by Browsers

2013-10-07 Thread Trevor Perrin
On Mon, Oct 7, 2013 at 4:50 PM, Brian Smith br...@briansmith.org wrote: On Thu, Sep 12, 2013 at 7:06 AM, Julien Vehent jul...@linuxwall.info wrote: It seems that AES-256 is always 25% to 30% slower than AES-128, regardless of AES-NI, or the CPU family. The slowest implementation of

Re: Proposal to Change the Default TLS Ciphersuites Offered by Browsers

2013-10-07 Thread Mountie Lee
Hi. thanks for mail. the reason why SEED support give not so much impact is SEED is not used alone but used with other crypto algorithms (hash, asymmetric...) SHA2 hash required in e-commerce transaction by the korean regulation. and which is also used in TLSv1.1+. SEED can be used under

Re: Proposal to Change the Default TLS Ciphersuites Offered by Browsers

2013-10-07 Thread Brian Smith
On Mon, Oct 7, 2013 at 6:05 PM, Mountie Lee moun...@paygate.net wrote: SHA2 hash required in e-commerce transaction by the korean regulation. and which is also used in TLSv1.1+. Hi, First, we will be enabling TLS 1.2 in Firefox very soon. But, I think you may be referring to SHA-2-based