Security defaults

[Cantor, Scott]

On 5/16/14, 8:30 PM, "Brent Putman" <putmanb at georgetown.edu> wrote:
>
>Remember that config instances with a higher order of precedence may
>duplicate these in their lists, with a different ordering, with as few
>or as many as desired (i.e. you don't need to enumerate them all, just
>the ones you want to express at that particular config level).

So, correct me, but the purpose of listing multiple algorithms is
basically to "survive" a blaclist imposed at some level? So if the first
one in the list is blacklisted, the order matters because it will pick the
second.

It's a little confusing I think because if you look at, say, RSA PKCS 1.5
key transport, which we'll be blacklisting, having it listed in the global
defaults seems kind of odd.

I guess I understand the point, not having to add it back there if
somebody wants to override the blacklist for a particularly regressive SP?

It's going to be pretty crucial to document the steps you want to take to
do certain things here.

-- Scott