Re: [openssl-dev] DTLS encrypt-then-mac

2016-10-13 Thread David Woodhouse
On Thu, 2016-10-13 at 23:48 +0100, Matt Caswell wrote: > > > Any dissenting opinions? > > Not from me. It's broken. Lets fix it. Thanks. https://github.com/openssl/openssl/pull/1705 updated accordingly. With that fixed, I think https://github.com/openssl/openssl/pull/1666 is now ready to be

Re: [openssl-dev] DTLS encrypt-then-mac

2016-10-13 Thread Matt Caswell
On 13/10/16 11:45, David Woodhouse wrote: > ... is broken in 1.1. We negotiate it, then don't actually *do* it. > > https://github.com/openssl/openssl/pull/1705 contains a patch to > disable it unconditionally for DTLS, on both server and client. > > In that same PR there's also a patch to