[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]


Reckhard, Tobias wrote:
There are web browsers that will negotiate 128 bits only if the
certificate presented by the web server is a "step-up certificate".
I'm not sure what makes a certificate a step-up certificate, however,
nor if this restriction still applies to current browsers.

The step up involved the browser checking the signer was a legitimate CA
to sign a step-up cert and then performing the re-negotiation. The
restriction disapeared when the crypto export laws were all relaxed. You
have to go a fair way back (few years) to get a browser that still only
supports 128bit symmetric in SGC mode.


Reply to: