IETF Logo Mail Archive

Re: [saag] AD review of draft-iab-crypto-alg-agility-06

Eliot Lear <lear@cisco.com> Wed, 26 August 2015 11:50 UTC

Return-Path: <lear@cisco.com>
X-Original-To: saag@ietfa.amsl.com
Delivered-To: saag@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD35D1ACD55 for <saag@ietfa.amsl.com>; Wed, 26 Aug 2015 04:50:00 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.511
X-Spam-Level:
X-Spam-Status: No, score=-14.511 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pY4gzpKh29Qa for <saag@ietfa.amsl.com>; Wed, 26 Aug 2015 04:49:59 -0700 (PDT)
Received: from aer-iport-3.cisco.com (aer-iport-3.cisco.com [173.38.203.53]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 62AED1AC41D for <saag@ietf.org>; Wed, 26 Aug 2015 04:49:59 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1362; q=dns/txt; s=iport; t=1440589799; x=1441799399; h=subject:to:references:from:message-id:date:mime-version: in-reply-to; bh=4C7kJ7v/Yxz0Kz1oSrzvR6EiXihM3Kq4oMjkdMri/7o=; b=ZY7l4ITyeY92KFy5KAO4Q0DIjjPPLy/xxoY2RptE7ClHeeJw2+PV1CDz NbvHgQNJTNucRQPOBDN3PMAiOMDlH0I2rVhKtaTiuKsMZWnvtHYiLDTne ixb5idfUMTpSHaMZD/Rnrz4m45iKJChWWQ3x2yBi52+LSNhbR56687GAf o=;
X-Files: signature.asc : 481
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0CgBADHpt1V/xbLJq1dh3vCPQKCBAEBAQEBAYELhCQBAQMBI1UGCwshFgsCAgkDAgECAUUTCAEBiCIIs0iUfwEBAQcCIItbhREXglKBQwEEhyaGcYcggkCBXIhWiHeRZCaEADyCfwEBAQ
X-IronPort-AV: E=Sophos;i="5.17,415,1437436800"; d="asc'?scan'208";a="604712460"
Received: from aer-iport-nat.cisco.com (HELO aer-core-1.cisco.com) ([173.38.203.22]) by aer-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 26 Aug 2015 11:49:57 +0000
Received: from [10.61.210.101] ([10.61.210.101]) by aer-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id t7QBnvdZ008744 for <saag@ietf.org>; Wed, 26 Aug 2015 11:49:57 GMT
To: saag@ietf.org
References: <20150728053035.GR4347@mournblade.imrryr.org> <CAHbuEH7B3_G9vAhw=U2tuz-Uh8mKMUfL6s=H+BOG96FDZaACig@mail.gmail.com> <20150824212907.GN9021@mournblade.imrryr.org> <619ffebb05ba4e2a9af03a6dcc768d6e@ustx2ex-dag1mb2.msg.corp.akamai.com> <20150824215037.GO9021@mournblade.imrryr.org> <9A043F3CF02CD34C8E74AC1594475C73F4AE62A1@uxcn10-5.UoA.auckland.ac.nz> <20150825134333.GX9021@mournblade.imrryr.org> <6b5167f3d0684a8a91caa6d37dec65e3@ustx2ex-dag1mb2.msg.corp.akamai.com> <20150825160627.GH9021@mournblade.imrryr.org> <55DC961A.903@cs.tcd.ie> <20150825165539.GL9021@mournblade.imrryr.org>
From: Eliot Lear <lear@cisco.com>
Message-ID: <55DDA7E4.1090807@cisco.com>
Date: Wed, 26 Aug 2015 13:49:56 +0200
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Thunderbird/38.2.0
MIME-Version: 1.0
In-Reply-To: <20150825165539.GL9021@mournblade.imrryr.org>
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="OiQ2lauL7QoRW5h94jTUvbfpeKllAu6C1"
Archived-At: <http://mailarchive.ietf.org/arch/msg/saag/CAScgZBuaYzk5OiR72wNsNy9pmI>
Subject: Re: [saag] AD review of draft-iab-crypto-alg-agility-06
X-BeenThere: saag@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Security Area Advisory Group <saag.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/saag>, <mailto:saag-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/saag/>
List-Post: <mailto:saag@ietf.org>
List-Help: <mailto:saag-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/saag>, <mailto:saag-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 26 Aug 2015 11:50:01 -0000

Hi,

On 8/25/15 6:55 PM, Viktor Dukhovni wrote:

> The nasty part is that cleartext fallback is not always desirable
> or available.  Sendmail IIRC does not fall back after STARTTLS
> handshake failure.

Yes that's right.  Instead you get a 403 4.7.0 TLS handshake failed. 
This is now happening all over the place, as it turns out, due to the
recent changes to the OpenSSL library involving dh processing.

Eliot

v2.23.0 | Report a Bug | By Email