Merge branch 'master' of https://rhodecode.plunge.at/ach/ach-master

diff --git a/src/applied-crypto-hardening.tex b/src/applied-crypto-hardening.tex
index 068d1cf..e05b8d6 100644 (file)
--- a/src/applied-crypto-hardening.tex
+++ b/src/applied-crypto-hardening.tex
@@ -119,6 +119,13 @@
 
 
 \input{abstract}
+
+\newpage
+
+\tableofcontents
+
+\newpage
+
 \input{disclaimer}
 \input{motivation}
 \input{methods}

diff --git a/src/practical_settings.tex b/src/practical_settings.tex
index 68f6777..787f5c6 100644 (file)
--- a/src/practical_settings.tex
+++ b/src/practical_settings.tex
@@ -68,11 +68,12 @@ The results of following his adivce is a categorisation of cipher suites.
 \end{tabular}
 \end{center}
 
+A remark on the ``consider'' section: the BSI (Bundesamt f\"ur Sicherheit in der Informationstechnik, Germany) recommends in its technical report TR-02102-2\footnote{\url{https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR02102/BSI-TR-02102-2_pdf.html}} to \textbf{avoid} non-ephemeral\footnote{emphemeral keys (perfect forward secrecy) denotes a property where session keys are destroyed upon termination of the encrypted session} keys for any communication which might contain personal or sensitive data. In this document, we follow BSI's advice and therefore only keep cipher suites containing (EC)DH\textbf{E} variants. System administrators, who can not use perfect forward secrecy can still use the cipher suites in the consider section. We however, do not recommend them in this document.
 
 Note that the entries marked as "special" are cipher suites which are not common to all clients (webbrowsers etc).
 
 
-\subsubsection{Clients}
+\subsubsection{Client recommendations}
  
 Next we tested the cipher suites above on the following clients:
 
@@ -88,6 +89,7 @@ Next we tested the cipher suites above on the following clients:
 The result of testing the cipher suites with these clients gives us the following result and a preference order. 
 Should a client not be able to use a specific cipher suite, it will fall back to the next possible entry as given by the ordering.
 
+\begin{center}
 \begin{table}[h]
 \small
     \begin{tabular}{|l|l|l|l|l|}
@@ -103,15 +105,17 @@ Should a client not be able to use a specific cipher suite, it will fall back to
     8    & TLS\_DHE\_RSA\_WITH\_CAMELLIA\_256\_CBC\_SHA   &     0x0088 & Firefox                     \\ \hline
     9    & TLS\_DHE\_DSS\_WITH\_CAMELLIA\_256\_CBC\_SHA   &     0x0087 & Firefox                     \\ \hline
     \end{tabular}
+\caption{Preference order of cipher suites}
 \end{table}
+\end{center}
 
 \FloatBarrier
 
 The same data again, specifying the OpenSSL name:
 
+\begin{center}
 \begin{table}[h]
 \small
-\FloatBarrier
     \begin{tabular}{|l|l|l|}
     \hline
     Cipher Suite                                   & ID            & OpenSSL Name                  \\ \hline
@@ -125,7 +129,9 @@ The same data again, specifying the OpenSSL name:
     TLS\_DHE\_RSA\_WITH\_CAMELLIA\_256\_CBC\_SHA   &     0x0088 &     DHE-RSA-CAMELLIA256-SHA   \\ \hline
     TLS\_DHE\_DSS\_WITH\_CAMELLIA\_256\_CBC\_SHA   &     0x0087 &     DHE-DSS-CAMELLIA256-SHA   \\ \hline
     \end{tabular}
+\caption{Preference order of cipher suites, with OpenSSL names}
 \end{table}
+\end{center}