[cabfpub] Draft ballot to create the SSL Performance Working Group

[Rob Stradling]

On 14/10/13 17:31, Gervase Markham wrote:
<snip>
> At the face-to-face and on the last call, interest was expressed in
> creating a Working Group to look at issues related to getting the best
> performance out of an SSL deployment. The aim would be to write one or
> more best practice documents such that all involved can collaborate to
> make sure that SSL websites have the best possible performance, so
> promoting the security and welfare of the web.

Gerv, how does it follow that "best possible performance" leads to 
"promoting the security and welfare of the web" ?

SSL websites that want "best possible performance" still have a habit of 
prioritizing RC4 ciphers, not enabling forward secrecy, and using 
1024-bit RSA keys.  Or disabling SSL altogether!

I think this proposed WG needs to consider performance _and_ security, 
and make recommendations on how to achieve good performance without 
undermining security.

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online