IETF Logo Mail Archive

Re: [core] DTLS and Epochs

Carsten Bormann <cabo@tzi.org> Thu, 01 June 2017 16:37 UTC

Return-Path: <cabo@tzi.org>
X-Original-To: core@ietfa.amsl.com
Delivered-To: core@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5AB9A12EC98 for <core@ietfa.amsl.com>; Thu, 1 Jun 2017 09:37:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.199
X-Spam-Level:
X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QdygCqbKUsFQ for <core@ietfa.amsl.com>; Thu, 1 Jun 2017 09:37:06 -0700 (PDT)
Received: from mailhost.informatik.uni-bremen.de (mailhost.informatik.uni-bremen.de [IPv6:2001:638:708:30c9::12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B5535128C84 for <core@ietf.org>; Thu, 1 Jun 2017 09:37:05 -0700 (PDT)
X-Virus-Scanned: amavisd-new at informatik.uni-bremen.de
Received: from submithost.informatik.uni-bremen.de (submithost.informatik.uni-bremen.de [IPv6:2001:638:708:30c9::b]) by mailhost.informatik.uni-bremen.de (8.14.5/8.14.5) with ESMTP id v51GaOCc016553; Thu, 1 Jun 2017 18:36:24 +0200 (CEST)
Received: from [192.168.217.113] (p5DC7F3A7.dip0.t-ipconnect.de [93.199.243.167]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by submithost.informatik.uni-bremen.de (Postfix) with ESMTPSA id 3wdtJm0s9ZzDH3l; Thu, 1 Jun 2017 18:36:24 +0200 (CEST)
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
From: Carsten Bormann <cabo@tzi.org>
In-Reply-To: <014601d2daf1$8f1865c0$ad493140$@augustcellars.com>
Date: Thu, 01 Jun 2017 18:36:23 +0200
Cc: weigengyu <weigengyu@bupt.edu.cn>, Klaus Hartke <hartke@tzi.org>, core@ietf.org
X-Mao-Original-Outgoing-Id: 518027783.462149-76ac1c026ac756329931b154036d1eb5
Content-Transfer-Encoding: quoted-printable
Message-Id: <849AEC05-87E3-48A7-B5C6-E6B6C8DC98D5@tzi.org>
References: <003501d2cd32$c4417a10$4cc46e30$@augustcellars.com> <CAAzbHvYb39cPMmw_S0eZ4RSwzzmcE7636tjyu=kyCbUtBOwb0g@mail.gmail.com> <005e01d2cd8f$ae548dc0$0afda940$@augustcellars.com> <BC45A96C78AE43AF896A65A184D287B5@WeiGengyuPC> <014601d2daf1$8f1865c0$ad493140$@augustcellars.com>
To: Jim Schaad <ietf@augustcellars.com>
X-Mailer: Apple Mail (2.3273)
Archived-At: <https://mailarchive.ietf.org/arch/msg/core/8wZTgth9n6PrfbqMOuVmj3nEzkA>
Subject: Re: [core] DTLS and Epochs
X-BeenThere: core@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Constrained RESTful Environments \(CoRE\) Working Group list" <core.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/core>, <mailto:core-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/core/>
List-Post: <mailto:core@ietf.org>
List-Help: <mailto:core-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/core>, <mailto:core-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 01 Jun 2017 16:37:08 -0000

On Jun 1, 2017, at 18:10, Jim Schaad <ietf@augustcellars.com> wrote:
> 
> Please note - I did not say that the epoch was not changed, I said that it does not tell me that the epoch has changed.  From a strictly security point of view there is no reason to do so if, for example, the epoch changed just because the key was rolled over.

Right, and the question for me is:  How do we get from the overly restrictive spec in 7252 to something that is still secure and can be supported by TLS libraries that are out there.

Grüße, Carsten

v2.46.0 | Report a Bug | By Email | System Status