added remark about weak ciphers

diff --git a/src/cipher_suites.tex b/src/cipher_suites.tex
index 62c3b93..8ad4fec 100644 (file)
--- a/src/cipher_suites.tex
+++ b/src/cipher_suites.tex
@@ -178,6 +178,10 @@ by copy and paste and needs to just work.
 \subsection{Known insecure and weak cipher suites}
 \todo{PG: please write this section. List all known broken, obsolete, weak and insecure cipher suites . Or even better: find the best site which keeps track of outdated cipher suites and simply reference it. We do not want to maintain such a list ourselves!}
 
 \subsection{Known insecure and weak cipher suites}
 \todo{PG: please write this section. List all known broken, obsolete, weak and insecure cipher suites . Or even better: find the best site which keeps track of outdated cipher suites and simply reference it. We do not want to maintain such a list ourselves!}
 

+Ciphers with 112bit or less are considered weak and aren't recommended. Note that
+\texttt{3DES} provides only 112bit of security
+\footnote{url{http://csrc.nist.gov/publications/PubsSPs.html#800-57-part1}}.
+

 \subsection{Compatibility}
 \todo{write this section. The idea here is to first document which server (and openssl) version we assumed. Once these parameters are fixed, we then list all clients which are supported for Variant A) and B). Therefore we can document compatibilities to some extent. The sysadmin can then choose roughly what he looses or gains by omitting certain cipher suites.}
 
 \subsection{Compatibility}
 \todo{write this section. The idea here is to first document which server (and openssl) version we assumed. Once these parameters are fixed, we then list all clients which are supported for Variant A) and B). Therefore we can document compatibilities to some extent. The sysadmin can then choose roughly what he looses or gains by omitting certain cipher suites.}