Re: [TLS] Issue 56: AES as MTI

[Nelson B Bolyard <nelson at bolyard.com>]

Russ Housley wrote:
> This has always been the case.  It ensures that there is a ciphersuite
> that can be negotiated between all implementations (unless it is
> explicitly turned off by policy controls).

And this is important why?

It is important that all implementations that must work in (say) US DOD
government installations (where AES is mandated exclusively) must all
use AES so that they can interoperate.  That market requires that they
interoperate.

It is important that in the field of eCommerce, where everyone uses RC4,
that implementations use RC4 so that they can interoperate for eCommerce.

An implementation that does RC4 and not AES will work fine in eCommerce
and not in the DOD.  An implementation that does AES only and not RC4
will not work with quite a few eCommerce servers out there.  So what?

Why do we need to impose interoperability requirements that the markets
themselves do not demand?

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls