A previous generation's hard-line "code is speech" stance is the only reason you didn't send this post through a 40-bit ciphersuite
I have enormous respect for FIRE but I think this First Amendment argument for Anthropic is a mistake and a very dangerous position—we don't want everything an AI does to be covered by the First Amendment. www.fire.org/research-lea...
March 10, 2026 at 10:19 PM
A previous generation's hard-line "code is speech" stance is the only reason you didn't send this post through a 40-bit ciphersuite
it does require some `unsafe` fuckery to get `embedded-tls` and `esp-hal` to play nice 😬 but might be safe? maybe not? who knows.
Also it doesn't work with my own SMTP server because my ciphersuite is too strict 💀
Also it doesn't work with my own SMTP server because my ciphersuite is too strict 💀
July 29, 2025 at 11:24 PM
it does require some `unsafe` fuckery to get `embedded-tls` and `esp-hal` to play nice 😬 but might be safe? maybe not? who knows.
Also it doesn't work with my own SMTP server because my ciphersuite is too strict 💀
Also it doesn't work with my own SMTP server because my ciphersuite is too strict 💀
reddit is detecting and blocking redlib by matching against the default rustls ciphersuite, which redlib uses github.com/redlib-org/r...
this is some petty shit
this is some petty shit
Avoid 403 by Changing Ciphers List by Silvenga · Pull Request #510 · redlib-org/redlib
As mentioned here #446 (comment), and investigated further here #446 (comment), reddit seems to be blocking on the exact ciphers default in rusttls.
This PR sets the list to that of Firefox.
github.com
December 4, 2025 at 7:01 AM
reddit is detecting and blocking redlib by matching against the default rustls ciphersuite, which redlib uses github.com/redlib-org/r...
this is some petty shit
this is some petty shit
See the blog post cryspen.com/post/pq-bert...
The page only supports X25519MLKEM768. If your browser doesn't support the ciphersuite, it won't show you anything.
The page only supports X25519MLKEM768. If your browser doesn't support the ciphersuite, it won't show you anything.
cryspen.com
December 24, 2024 at 11:49 AM
See the blog post cryspen.com/post/pq-bert...
The page only supports X25519MLKEM768. If your browser doesn't support the ciphersuite, it won't show you anything.
The page only supports X25519MLKEM768. If your browser doesn't support the ciphersuite, it won't show you anything.
OpenSSL 3.5でポスト量子暗号のAEGISベースのTLS Ciphersuiteに対応予定。nginxに組み込みも可能。TLS_AEGIS_128L_SHA256とTLS_AEGIS_128X2_SHA256らしい。またひとつ覚えることが増えました。
How to enable post-quantum key exchange and AEGIS in Nginx | Frank DENIS random thoughts.
00f.net
March 30, 2025 at 1:20 PM
OpenSSL 3.5でポスト量子暗号のAEGISベースのTLS Ciphersuiteに対応予定。nginxに組み込みも可能。TLS_AEGIS_128L_SHA256とTLS_AEGIS_128X2_SHA256らしい。またひとつ覚えることが増えました。
Cloudflare brings post-quantum encryption to IPsec using hybrid ML-KEM, cutting through ciphersuite bloat while defending against "harvest now, decrypt later" attacks. No special hardware needed, no extra cost. #postquantum #cloudflare #cybersecurity #ipsec www.infoq.com/news/2026/03...
Standardizing Post-Quantum IPsec: Cloudflare Adopts Hybrid ML-KEM to Replace Ciphersuite Bloat
Cloudflare has extended hybrid post-quantum encryption to IPsec and WAN traffic, standardizing its SASE stack ahead of the NIST 2030 deadline. By adopting a streamlined ML-KEM key exchange, the move a...
www.infoq.com
March 10, 2026 at 11:13 AM
Cloudflare brings post-quantum encryption to IPsec using hybrid ML-KEM, cutting through ciphersuite bloat while defending against "harvest now, decrypt later" attacks. No special hardware needed, no extra cost. #postquantum #cloudflare #cybersecurity #ipsec www.infoq.com/news/2026/03...
can't wait for `draft-ietf-openpgp-pqc-17`, A/K/A "Post-Quantum Cryptography in OpenPGP", document to land. i'd love to move my pgp certs to a more modern ciphersuite, using slh-dsa or at least mldsa87+ed448 to authorise and issue subkeys (which themselves won't be pqc for the forseeable future […]
Original post on chitter.xyz
chitter.xyz
June 15, 2026 at 1:34 PM
can't wait for `draft-ietf-openpgp-pqc-17`, A/K/A "Post-Quantum Cryptography in OpenPGP", document to land. i'd love to move my pgp certs to a more modern ciphersuite, using slh-dsa or at least mldsa87+ed448 to authorise and issue subkeys (which themselves won't be pqc for the forseeable future […]
FROST v3.0.0 is here! 🧊 This stable release follows v3.0.0-rc.0, which introduced the bulk of changes in this major version.
Upgrading from v2.x? Read the RC release post for the full picture. Full release notes on GitHub, updated docs at frost.zfnd.org.
zfnd.org/frost-releas...
Upgrading from v2.x? Read the RC release post for the full picture. Full release notes on GitHub, updated docs at frost.zfnd.org.
zfnd.org/frost-releas...
FROST Release v3.0.0 - Zcash Foundation
We have just released FROST v3.0.0. You can find frost-core and the ciphersuite crates available on crates.io. This stable release follows v3.0.0-rc.0, which introduced the bulk of the changes in…
zfnd.org
April 23, 2026 at 7:04 PM
FROST v3.0.0 is here! 🧊 This stable release follows v3.0.0-rc.0, which introduced the bulk of changes in this major version.
Upgrading from v2.x? Read the RC release post for the full picture. Full release notes on GitHub, updated docs at frost.zfnd.org.
zfnd.org/frost-releas...
Upgrading from v2.x? Read the RC release post for the full picture. Full release notes on GitHub, updated docs at frost.zfnd.org.
zfnd.org/frost-releas...
Let's Encrypt、7/24からHTTP-01/TLS-ALPN-01におけるTLSハンドシェイクで一部ciphersuiteを廃止。TLS1.2でも非推奨とciphersuiteなので影響は少ない(0.004%)はずだが更新されなくなったらこれが原因の可能性あります。ご注意ください
Disabling deprecated TLS cipher suites during validation
We will be disabling support for certain rare and obsolete algorithms in TLS handshakes conducted by the HTTP-01 and TLS-ALPN-01 validation methods. Specifically, we are disabling the following cipher suites: TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA We currently observe nearly zero usage of these cipher suites: only 0.004% of successful HTTP-01 and TLS-ALPN-01 validations end up usin...
community.letsencrypt.org
July 13, 2024 at 11:58 PM
Let's Encrypt、7/24からHTTP-01/TLS-ALPN-01におけるTLSハンドシェイクで一部ciphersuiteを廃止。TLS1.2でも非推奨とciphersuiteなので影響は少ない(0.004%)はずだが更新されなくなったらこれが原因の可能性あります。ご注意ください
...and, after my second crufty old OpenSSL build, it turned out the ciphersuite I needed was SSL_RSA_WITH_RC4_128_SHA. I hate this timeline.
June 17, 2023 at 8:53 AM
...and, after my second crufty old OpenSSL build, it turned out the ciphersuite I needed was SSL_RSA_WITH_RC4_128_SHA. I hate this timeline.
Blogged: [HOWTO] Set Minimum TLS Cipher Suite of Azure App Service using Terraform
#Azure #AzureAppService #IaC #terraform #security #tls #ciphersuite
#Azure #AzureAppService #IaC #terraform #security #tls #ciphersuite
[HOWTO] Set Minimum TLS Cipher Suite of Azure App Service using Terraform
An application’s pentest revealed weak SSL/TLS cipher suites in Azure App Services. To enhance security, non-forward-secrecy cipher suites must be disabled. Utilizing Terraform and the azapi provider, a workaround was implemented to configure the Minimum TLS Cipher Suite, enforcing modern cryptographic standards.
blog.rufer.be
February 3, 2025 at 7:44 AM
Blogged: [HOWTO] Set Minimum TLS Cipher Suite of Azure App Service using Terraform
#Azure #AzureAppService #IaC #terraform #security #tls #ciphersuite
#Azure #AzureAppService #IaC #terraform #security #tls #ciphersuite
За неща като TLS няма да е сложно, просто ще пуснат нова ревизия с подръжката им в ciphersuite-а, CA-тата ще заменят постепенно ключовете и бавно и плавно това ще се случи без големи драми. За неща като биткойн вече ще е забава.
February 21, 2025 at 3:51 PM
За неща като TLS няма да е сложно, просто ще пуснат нова ревизия с подръжката им в ciphersuite-а, CA-тата ще заменят постепенно ключовете и бавно и плавно това ще се случи без големи драми. За неща като биткойн вече ще е забава.
After the irritation of trying to sort out an IBM MQ ciphersuite issue, I am in full-on troubleshoot-fix-document mode with this PR for HawtIO
github.com/hawtio/websi...
github.com/hawtio/websi...
Update documentation to refer to hawtio-springboot4 dependency by poggs · Pull Request #71 · hawtio/website
The hawtio-springboot dependency does not work with Spring Boot 4. I only found the hawtio-springboot4 dependency by searcing Maven Central.
This PR updates the Getting Started document to referen...
github.com
June 1, 2026 at 11:02 AM
After the irritation of trying to sort out an IBM MQ ciphersuite issue, I am in full-on troubleshoot-fix-document mode with this PR for HawtIO
github.com/hawtio/websi...
github.com/hawtio/websi...
We have now concluded our development work on the FROST reference implementation, frost-core, along with the ciphersuite crates. The next step is for wallets to integrate FROST using those tools directly or as reference, ZF will provide guidance as needed. zfnd.org/the-state-of...
The State of FROST for Zcash
FROST, which stands for Flexible Round-Optimized Schnorr Threshold, is an advanced cryptographic protocol designed to improve threshold signature schemes. Unlike traditional single-party signatures,…
zfnd.org
May 20, 2025 at 4:49 PM
We have now concluded our development work on the FROST reference implementation, frost-core, along with the ciphersuite crates. The next step is for wallets to integrate FROST using those tools directly or as reference, ZF will provide guidance as needed. zfnd.org/the-state-of...
#OpenSSL 3.5.0 is out. first version with #PQC key-exchange algorithms. Will wait to get the www.iana.org/assignments/... updated with new TLS ciphersuite parameters.
Release OpenSSL 3.5.0 · openssl/openssl
OpenSSL 3.5.0 is a feature release adding significant new functionality to
OpenSSL.
This release incorporates the following potentially significant or incompatible
changes:
Default encryption cip...
github.com
April 9, 2025 at 6:45 AM
#OpenSSL 3.5.0 is out. first version with #PQC key-exchange algorithms. Will wait to get the www.iana.org/assignments/... updated with new TLS ciphersuite parameters.
Useful tutorial guide on how to enable SSL using Let's Encrypt and get an A+ rating from SSL Labs. https://www.howtoforge.com/tutorial/nginx-with-letsencrypt-ciphersuite/
February 12, 2024 at 8:43 AM
Useful tutorial guide on how to enable SSL using Let's Encrypt and get an A+ rating from SSL Labs. https://www.howtoforge.com/tutorial/nginx-with-letsencrypt-ciphersuite/
Feed: "Zcash Foundation"
By: admin on Thursday, April 23, 2026
By: admin on Thursday, April 23, 2026
FROST Release v3.0.0
We have just released FROST v3.0.0. You can find frost-core and the ciphersuite crates available on crates.io. This stable release follows v3.0.0-rc.0, which introduced the bulk of the changes in this major version. If you are upgrading from v2.x, please read the RC release post for the full picture—the changes described here are what’s new […]
zfnd.org
April 24, 2026 at 1:33 AM
Feed: "Zcash Foundation"
By: admin on Thursday, April 23, 2026
By: admin on Thursday, April 23, 2026
us, 30 days ago: the handshakes fail when they get split up over two packets regardless of the ciphersuite
3 different AWS guys, for 30 days: uhhhhhhhhh have you considered this an incompatibility with the ciphersuite? i can't reproduce this. (various wrong obviously-slopped-out things about […]
3 different AWS guys, for 30 days: uhhhhhhhhh have you considered this an incompatibility with the ciphersuite? i can't reproduce this. (various wrong obviously-slopped-out things about […]
Original post on infosec.exchange
infosec.exchange
March 11, 2026 at 10:56 PM
us, 30 days ago: the handshakes fail when they get split up over two packets regardless of the ciphersuite
3 different AWS guys, for 30 days: uhhhhhhhhh have you considered this an incompatibility with the ciphersuite? i can't reproduce this. (various wrong obviously-slopped-out things about […]
3 different AWS guys, for 30 days: uhhhhhhhhh have you considered this an incompatibility with the ciphersuite? i can't reproduce this. (various wrong obviously-slopped-out things about […]
- Security: Added "ats fcp" ciphersuite group
never heard of this, does anyone know about it?
never heard of this, does anyone know about it?
April 14, 2026 at 8:51 PM
- Security: Added "ats fcp" ciphersuite group
never heard of this, does anyone know about it?
never heard of this, does anyone know about it?
ID: CVE-2024-5814
CVSS V4.0: MEDIUM
A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection. This is because, aside from the extensions, the client was skipping...
#security #infosec #cve-alert
CVSS V4.0: MEDIUM
A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection. This is because, aside from the extensions, the client was skipping...
#security #infosec #cve-alert
nvd.nist.gov
August 27, 2024 at 7:15 PM
ID: CVE-2024-5814
CVSS V4.0: MEDIUM
A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection. This is because, aside from the extensions, the client was skipping...
#security #infosec #cve-alert
CVSS V4.0: MEDIUM
A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection. This is because, aside from the extensions, the client was skipping...
#security #infosec #cve-alert
And it's not the TLS 1.3 single ciphersuite config deal! I set the max TLS version in the tests to 1.2 etc. Part of it is the loop is now over only the supported cipher suites instead a a goto that implicitly let me keep the ordering for the unsupported meta ciphersuites that are used by browsers
July 8, 2023 at 9:53 PM
And it's not the TLS 1.3 single ciphersuite config deal! I set the max TLS version in the tests to 1.2 etc. Part of it is the loop is now over only the supported cipher suites instead a a goto that implicitly let me keep the ordering for the unsupported meta ciphersuites that are used by browsers