On Thursday, 4 April 2019 23:06:07 CEST Frank Ueberschar wrote:
Here https://docs.fedoraproject.org/en-US/packaging-guidelines/CryptoPolicies/ is a proposal to use a specific cipher list string for SSL_CTX_set_cipher_list(): "PROFILE=SYSTEM".
Especially this citation: "if that call is present and provided a fixed string which does not contain PSK or SRP, replace the string with "PROFILE=SYSTEM", or remove the call"
We have to rely on PSK. What ist the reason behind the above advice?
Thanks, Frank
more or less what David said. PSK and SRP are very specific use cases, ones that don't work in open Internet and require close cooperation and communication between server administrator and user. Crypto Policies target common use cases with typical configurations (i.e. X.509 certificate authentication).