On 2016-08-15 13:09, Alex Gaynor wrote:
>
> Alex Gaynor added the comment:
>
> So, for servers really what we care about is if the _client_ has PCLMULQDQ/AESNI, not whether the server itself does. Unfortunately, there's no sane way to do this.
For servers we want to prefer CHACHA20 over AESGCM iff both sides have
AES-NI and CLMUL. A server on a device such as a RPi benefits from
CHACHA20, too. For that reason I also changed the server side cipher string.
As you already said, there is no way to express this with OpenSSL cipher
suite string.