Re: [kitten] draft-hansen-scram-sha256 and incorporating session hashing for channel binding

[Stephen Farrell <[e-mail]>]

On 23/05/15 23:44, Simon Josefsson wrote:
> Perhaps this is a question for the TLS WG -- whether they intend
> tls-session-hash to apply as a mandatory fix to all TLS versions or
> not.  The document does not say anything about updates now, which means
> "TLS needs fixing" won't necessarily happen.

So this may be helpful or not depending on how much one
considers IETF minutae important...

During IESG evaluation we agreed to have the session hash
document be an update of 5246. The start of that thread is
at [1] and the resolution is downthread or maybe in some
other thread but was on the TLS list. The update to the
draft hasn't yet happened but will shortly.

The impact is that our formalities then expect any new TLS
code to include session hash. But that of course does not
affect already deployed code so make of that what you will.

Cheers,
S.

[1] https://www.ietf.org/mail-archive/web/tls/current/msg16231.html