Re: A couple of questions and concerns about Emacs network security

[Lars Ingebrigtsen]

Jimmy Yuen Ho Wong <address@hidden> writes:

> Currently `network-security-level` 'high and above *only* checks for the case
> with prime bits < 1024. I can't fine tune the specific checks (very much
> necessary given Emacs' release cycle) in `network-security-level` to
> something like:
>
>     (setq gnutls-algorithm-priority
> "SECURE192:+SECURE128:-VERS-ALL:+VERS-TLS1.2:%PROFILE_MEDIUM"
>              gnutls-min-prime-bits 2048)
>
> **AND** have NSM warn me if I'm presented a 3DES cert or a cert with a DH
> prime between 1024 and 2048.

Like I said in a different email, I'll be rewriting the checks to allow
the user to add as fine-grained checks they want to the NSM via
something like:

(defvar network-security-tls-problems
        '((low-diffie-hellman-prime-bits medium)
          (rc4 low)
          (dh-small-subgroup high)))

But you'd leave the gnutls variables alone.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no