Re: What to advertise when mandatory ciphers not implemented

At 05:16 PM 3/18/98 -0800, John Myers wrote:
>I have two choices:
>
>1) I can advertise the STARTTLS extension even though the extension does
>not conform to the mandatory-to-implement cipher requirements.
>
>2) I can advertise a private XSTARTSSL extension which behaves exactly
>like STARTTLS, but does not have the mandatory cipher requirement.
>
>While it is ugly and nonconforming, I believe (1) will lead to better
>interoperability.

I agree.

>To a client, it is indistinguishable from a
>conforming server which has had those ciphers disabled by the admin. 
>(The trick is to keep marketing from claiming TLS conformance.)

Dream on. :-)

>I'll do
>(2) if the community thinks it is the better choice.

It's a terrible choice.

--Paul Hoffman, Director
--Internet Mail Consortium