zERT - Match the least common denominator of a rule

With the current setup of Reusable Rules that combines a combination of

• Traffic Descriptor

• Data Endpoints

• TLS or SSH version

• Protection Characteristics

It is required that all of the specifics match to trigger the required action. This behavior can lead to a massive number of required combinations, especially for the Protection Characteristics.

Compiling a Reusable Rule consisting of definitions for

• Symmetric Encryption

• Message Authentication

• Key Exchange

I expect that zERT will trigger the associated action if the least common denominator matches.

Following the example of a rule that should trigger the reset of a (SSH) connection with its defined details for the protection characteristics:

Following Details for the connection that should be reset:

Symmetric Encryption Algorithms: AES-CBC-128

SSH Key Exchange Algorithms: diffie-hellman-group1-sha1

Based on the used Key Exchange I would expect that this connection is reset, however as the Symmetric Encryption does not match, this connection is just allowed.

I expect that for this 'reset' rule it should reset the connection if just either of the protection characteristics does match that is not expected to be allowed.

Th above rule will never match to reset the connection as only the Symmetric Encryption does not match. However, I would expect from such a rule that the least common denominator is relevant hence the weakest definition for a Protection Characteristic defines it for the whole rule. To achieve the same with the current setup I would have to triple the amount of rules and have one that defines the Symmetric Encryption and allows any Key Exhange and Message Authentication. Then the same that allows any Symmetric Encryption but with specifics for Key Exhange and any Message Authentication and last, any Symmetric Encryption, any Key Exchange but with specifics for Authentication Algorithms.