Re: ZEO SSL support and Daft docs

On Wed, 22 Jun 2016 17:07:00 -0400, Jim Fulton <[email protected]>
wrote:
> On Wed, Jun 22, 2016 at 4:43 PM, Patrick Strawderman <[email protected]> wrote:
> > and cipher
> > suites?  
> 
> I have no idea. Whatever you get by default in a SSLContext. :)

+1 for default SSL library ciphers suites.
At least with OpenSSL (and this is likely true for LibreSSL too) it
reacts to an environment variable to tell which to disable, which to
prefer, ... But I don't know if it is good practice to depend on this.

> > I would suggest not supporting SSL at all, and only supporting TLS.
> > It seems like ssl.create_default_context() disables SSLv2 and SSLv3, as well
> > as some weak ciphers, but it might make sense to provide a stricter default
> > for the ciphersuite list, and to disable compression (to mitigate attacks
> > like CRIME).  Note that Python >= 2.7.9 and Python >= 3.4 is a requirement
> > for a lot of these options in the ssl module.  
> 
> This sounds reasonable. I'll look into this.

I would go further than only disabling "SSL" (ie, <SSL 4.0): disable
<TLS 1.2 (ie, <SSL 4.2) by default (hence enabling 1.2 and any future
evolution), as there is no need for any backward compatibility right
now.

I think CRIME does not apply here, but I think it shouldn't hurt to
disable SSL-level compression.

I did not see mention of revocation lists (an option accepting a CRL
file). Although they are of no use with self-signed certificates, they
become important when a CA certificate exists.
OCSP is good too, but I expect this to be handled internally to the SSL
library, fetching its parameters from the signed certificate.

Regards,
-- 
Vincent Pelletier

-- 
You received this message because you are subscribed to the Google Groups "zodb" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
For more options, visit https://groups.google.com/d/optout.