User:Andersk

I was the Chief Architect and cofounder of Ksplice, Inc. I’m now a PhD student in computer science at MIT, where I also help run a web hosting service (https://scripts.mit.edu/). I’m a Debian Maintainer and a Quora Top Writer.

At the moment, having spent a few hours playing with SSL cipher suites, I’m mostly interested in contributing suggestions to Talk:Security/Server_Side_TLS:

• Why does the modern suite include DHE-DSS-AES256-SHA and DHE-DSS-AES128-SHA256 but exclude DHE-DSS-AES128-SHA and DHE-DSS-AES256-SHA256?
• It would be easier and less error prone to have OpenSSL generate and order the list, rather than apparently doing it by hand. For example, `AES128:-ALL:EECDH:-ALL:AESGCM:AES:!RSA:!MD5:!aECDH:!KRB5:!PSK:!SRP:!NULL:!aNULL` generates an equivalent of the modern suite modulo the above point in less than 1/6 of the space, and would be much more readable as a coherent policy with just a bit of explanation (from right to left: 1. require forward secrecy; 2. require AESGCM or AES and prefer AESGCM; 3. all else equal, prefer EECDH, 4. all else equal, prefer AES128).