X-Recipient:	archive-cygwin AT delorie DOT com
DomainKey-Signature:	a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=MwUwfixT7+6CJgedVXP43Uq8/MyGoKCrZ9q1+57m5bWpuzp7h/U1d
	ADC5uBm/b8bDofIvhbP8Iv8So+uYYZ9f+Ikevxgu6h800oYrPOOYUQ+xMmARm0kB
	eGP+YKjzIe9OzKz8qYdWDocaqADmHKmKWdIYXpU+mwobk+O7tvsYCQ=
DKIM-Signature:	v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; s=default;
	bh=ZbFZWtn1t8qN7EGAkxvYaMRvoh8=; b=nYfusga8XCdmqNwYw2OcngUfVbcu
	oUxBr59EiQzqGIE++iav6Rph/S9wEbQW3dAZg7OjlFCmyMb5OUvFA/0AqZKMyjPL
	7/EZgsY5FssO0LGjnc0WPHw4px0x/aufJsCn0/cf48KmlYNiXCnI/fn7J/iptjvE
	6Q0jyxIis1Wm0MU=
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Authentication-Results:	sourceware.org; auth=none
X-Virus-Found:	No
X-Spam-SWARE-Status:	No, score=-5.9 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.3.2
X-HELO:	calimero.vinschen.de
Date:	Mon, 9 Mar 2015 10:26:01 +0100
From:	Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To:	cygwin AT cygwin DOT com
Subject:	Re: How Cygwin counters man-in-the-middle (MITM) attacks
Message-ID:	<20150309092601.GD28200@calimero.vinschen.de>
Reply-To:	cygwin AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
References:	<E1YUgpo-0002Wt-L5 AT rmm6prod02 DOT runbox DOT com> <874mpvqnoh DOT fsf AT Rainer DOT invalid>
MIME-Version:	1.0
In-Reply-To:	<874mpvqnoh.fsf@Rainer.invalid>
User-Agent:	Mutt/1.5.23 (2014-03-12)

--EP0wieDxd4TSJjHq
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mar  8 20:44, Achim Gratz wrote:
> David A. Wheeler writes:
> >    I checked Cygwin.com's SSL/TLS implementation using Qualsys
> >    ( https://www.ssllabs.com/ssltest/ ). Cygwin.com got an overall rati=
ng
> >    of "B" (capped because it permits the RC4 cipher).

Isn't that rather due to the IDEA cypher:

> | Not valid after:  2016-05-20T11:00:00+00:00
> | MD5:   d888 b3ed 9f0f f8d1 5b57 fdd7 5122 bb53
> |_SHA-1: 349e 7f24 e249 2256 af2d 15a9 2883 ce84 4a40 a88f
> | ssl-enum-ciphers:=20
> |   SSLv3: No supported ciphers found
> |   TLSv1.0:=20
> |     ciphers:=20
> |       TLS_DHE_RSA_WITH_AES_128_CBC_SHA - strong
> |       TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA - strong
> |       TLS_DHE_RSA_WITH_SEED_CBC_SHA - strong
> |       TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
> |       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
> |       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - strong
> |       TLS_RSA_WITH_AES_256_CBC_SHA - strong
> |       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - strong
> |       TLS_RSA_WITH_IDEA_CBC_SHA - weak
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Also, again, Cygwin is just one project on sourceware.org.  It would be
nice if concerns like this would be addresses to the overseers mailing
list.


Corinna

--=20
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

--EP0wieDxd4TSJjHq
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBAgAGBQJU/WcpAAoJEPU2Bp2uRE+g7WsP/0WiHZZ0qZmd/oCV1xw9c5Jb
jj1yLSgVwKvUYQ98GYyowa81R4GWfUu2eqsURMbqI5al1uhoHq2bK/V5Ljd4e2tW
s4pM5GsyH1j6t/41fIgZI3e2Yd9lHC+9jQo/ge1E/yfAI0BxKAsTBsugXezWE4QC
x91T6InImK54FJ9sDFrcxO2shmYpqD3HmbuI7/IirIPmsyndkrxIQsL5ZbEWRBe5
Faw41JX2cZIwAQs0ww2uPLqeKXTYw6h8UEgFVL5RtWduhLxz67J8TDQYnjT7zEDH
7CfCnfchsh3w88WGwdopnPf9JPkxSBDJRD5B5aK6MwMDEhO3E9d439TUvAlXj1zE
ugZWLD56wQgx0yxSbEw/ohAH09N2TQusLN1+2fICDrmanAExwkFuUCwMtdC80nWX
coC1OTDrFp2LJceJlzYdGzxvqRRkMbrywj4UnCogcALBv43ApDUWRAI7Hqry3jtO
oJfHuWh6JMSq1G6qA1uaCCk2jsELxdKuBSyfHzkxF6M8Fqqnh+wXFvjStuazS8Le
5lo3taYMDQy3H+nmNZN/rLh++fCL1p+OPSgb4T6uUx4v/PAblIPw7MsQ8WacFpBl
+ZJjC8foj6bWHuAVpXdz6j6M1sCymr6NrEs0HWZ+l/p+O8VbXEpNUYKCVbRvsl51
DImNv4P6zNNJHGBsuQJw
=YN/f
-----END PGP SIGNATURE-----

--EP0wieDxd4TSJjHq--

- Raw text -