<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 06/22/2017 01:04 AM, Victor Stinner
wrote:<br>
</div>
<blockquote
cite="mid:CAMpsgwbT-kxNrSdwsWuzsWwqH8X8NaubPc59QdXsBsQQY3_Jeg@mail.gmail.com"
type="cite">
<div dir="auto">About the cipher list in ssl, the change itself is
simple but it's to blacklist DES and 3DES since it has been
proved that these ciphers are really too weak nowadays:
<div dir="auto"><a moz-do-not-send="true"
href="http://python-security.readthedocs.io/vuln/cve-2016-2183_sweet32_attack_des_3des.html">http://python-security.readthedocs.io/vuln/cve-2016-2183_sweet32_attack_des_3des.html</a><br>
</div>
</div>
</blockquote>
<br>
Not "blacklist"--IIUC the user can still manually specify whatever
cipher suites they like. And not DES... who knows how long ago that
was removed from the list.<br>
<br>
This change in 3.4 removes 3DES from the <i>default</i> permissible
cipher list, changing those entries to use "HIGH cipher suites"
instead (OpenSSL's term for "cipher suites with key sizes >= 128
bytes"). It also adds ChaCha20 to the default cipher list.<br>
<br>
<br>
<blockquote
cite="mid:CAMpsgwbT-kxNrSdwsWuzsWwqH8X8NaubPc59QdXsBsQQY3_Jeg@mail.gmail.com"
type="cite">
<div dir="auto">
<div dir="auto">By the way, is Larry the only one to be able to
merge changes in 3.4? Before GitHub, all core dev were
technically allowed to push in security-only branches.</div>
</div>
</blockquote>
<br>
Oh? Am I? **insert evil laugh** Ladies and gentlemen, get out your
checkbooks! 3.4 is about to get... expensive.<br>
<br>
Seriously, though, I was mostly hoping other people would handle the
security stuff and just keep me informed. If I'm the only one
permitted to accept PRs into 3.4 (and soon 3.5), okay, I can work
with that. I'm still probably gonna delegate the actual judgment of
the validity of the PRs. But obviously it'll mean I'll have to be
more hands-on, where so far I was assuming I could just let other
people handle it.<br>
<br>
<br>
<i>/arry</i><br>
</body>
</html>