View source for User:Andersk

I was the Chief Architect and cofounder of Ksplice, Inc.  I’m now a PhD student in computer science at MIT, where I also help run a web hosting service (https://scripts.mit.edu/).  I’m a Debian Maintainer and a Quora Top Writer.

At the moment, having spent a few hours playing with SSL cipher suites, I’m mostly interested in contributing suggestions to [[Talk:Security/Server_Side_TLS]]:

* Why does the modern suite include DHE-DSS-AES256-SHA and DHE-DSS-AES128-SHA256 but exclude DHE-DSS-AES128-SHA and DHE-DSS-AES256-SHA256?
* It would be easier and less error prone to have OpenSSL generate and order the list, rather than apparently doing it by hand.  For example, `AES128:-ALL:EECDH:-ALL:AESGCM:AES:!RSA:!MD5:!aECDH:!KRB5:!PSK:!SRP:!NULL:!aNULL` generates an equivalent of the modern suite modulo the above point in less than 1/6 of the space, and would be much more readable as a coherent policy with just a bit of explanation (from right to left: 1. require forward secrecy; 2. require AESGCM or AES and prefer AESGCM; 3. all else equal, prefer EECDH, 4. all else equal, prefer AES128).