DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=MwUwfixT7+6CJgedVXP43Uq8/MyGoKCrZ9q1+57m5bWpuzp7h/U1d
	ADC5uBm/b8bDofIvhbP8Iv8So+uYYZ9f+Ikevxgu6h800oYrPOOYUQ+xMmARm0kB
	eGP+YKjzIe9OzKz8qYdWDocaqADmHKmKWdIYXpU+mwobk+O7tvsYCQ=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Date: Mon, 9 Mar 2015 10:26:01 +0100
From: Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To: cygwin AT cygwin DOT com
Subject: Re: How Cygwin counters man-in-the-middle (MITM) attacks
Message-ID: <20150309092601.GD28200@calimero.vinschen.de>
Reply-To: cygwin AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
References: <E1YUgpo-0002Wt-L5 AT rmm6prod02 DOT runbox DOT com> <874mpvqnoh DOT fsf AT Rainer DOT invalid>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;	protocol="application/pgp-signature"; boundary="EP0wieDxd4TSJjHq"
Content-Disposition: inline
In-Reply-To: <874mpvqnoh.fsf@Rainer.invalid>
User-Agent: Mutt/1.5.23 (2014-03-12)

--EP0wieDxd4TSJjHq
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mar  8 20:44, Achim Gratz wrote:
> David A. Wheeler writes:
> >    I checked Cygwin.com's SSL/TLS implementation using Qualsys
> >    ( https://www.ssllabs.com/ssltest/ ). Cygwin.com got an overall rati=
ng
> >    of "B" (capped because it permits the RC4 cipher).

Isn't that rather due to the IDEA cypher:

> | Not valid after:  2016-05-20T11:00:00+00:00
> | MD5:   d888 b3ed 9f0f f8d1 5b57 fdd7 5122 bb53
> |_SHA-1: 349e 7f24 e249 2256 af2d 15a9 2883 ce84 4a40 a88f
> | ssl-enum-ciphers:=20
> |   SSLv3: No supported ciphers found
> |   TLSv1.0:=20
> |     ciphers:=20
> |       TLS_DHE_RSA_WITH_AES_128_CBC_SHA - strong
> |       TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA - strong
> |       TLS_DHE_RSA_WITH_SEED_CBC_SHA - strong
> |       TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
> |       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
> |       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - strong
> |       TLS_RSA_WITH_AES_256_CBC_SHA - strong
> |       TLS_RSA_WITH_CAMELLIA_128_CBC_SHA - strong
> |       TLS_RSA_WITH_IDEA_CBC_SHA - weak
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Also, again, Cygwin is just one project on sourceware.org.  It would be
nice if concerns like this would be addresses to the overseers mailing
list.


Corinna

--=20
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

--EP0wieDxd4TSJjHq
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBAgAGBQJU/WcpAAoJEPU2Bp2uRE+g7WsP/0WiHZZ0qZmd/oCV1xw9c5Jb
jj1yLSgVwKvUYQ98GYyowa81R4GWfUu2eqsURMbqI5al1uhoHq2bK/V5Ljd4e2tW
s4pM5GsyH1j6t/41fIgZI3e2Yd9lHC+9jQo/ge1E/yfAI0BxKAsTBsugXezWE4QC
x91T6InImK54FJ9sDFrcxO2shmYpqD3HmbuI7/IirIPmsyndkrxIQsL5ZbEWRBe5
Faw41JX2cZIwAQs0ww2uPLqeKXTYw6h8UEgFVL5RtWduhLxz67J8TDQYnjT7zEDH
7CfCnfchsh3w88WGwdopnPf9JPkxSBDJRD5B5aK6MwMDEhO3E9d439TUvAlXj1zE
ugZWLD56wQgx0yxSbEw/ohAH09N2TQusLN1+2fICDrmanAExwkFuUCwMtdC80nWX
coC1OTDrFp2LJceJlzYdGzxvqRRkMbrywj4UnCogcALBv43ApDUWRAI7Hqry3jtO
oJfHuWh6JMSq1G6qA1uaCCk2jsELxdKuBSyfHzkxF6M8Fqqnh+wXFvjStuazS8Le
5lo3taYMDQy3H+nmNZN/rLh++fCL1p+OPSgb4T6uUx4v/PAblIPw7MsQ8WacFpBl
+ZJjC8foj6bWHuAVpXdz6j6M1sCymr6NrEs0HWZ+l/p+O8VbXEpNUYKCVbRvsl51
DImNv4P6zNNJHGBsuQJw
=YN/f
-----END PGP SIGNATURE-----

--EP0wieDxd4TSJjHq--