Re: [secdir] Security review of draft-ietf-tls-multiple-cert-status-extension-04

["Yngve N. Pettersen" <[e-mail]>]

Hello Hilarie,

Thanks for the review.

On Fri, 29 Mar 2013 21:34:55 +0100, Hilarie Orman <[e-mail]> wrote:

> Security review of draft-ietf-tls-multiple-cert-status-extension-04
>
> Do not be alarmed.  I have reviewed this document as part of the
> security directorate's ongoing effort to review all IETF documents
> being processed by the IESG.  These comments were written primarily
> for the benefit of the security area directors.  Document editors and
> WG chairs should treat these comments just like any other last call
> comments.
>
> The final paragraph in section 2.2 discusses using an unauthenticated
> session for the purpose of obtaining certificates in order to
> authenticate the session.  Sending usernames and passwords over the
> connection while unauthenticated is regarded as "inappropriate".  This
> seems to be a serious problem, deserving of at least a "MUST NOT".

I changed that to:

  "In this case, the client could continue with the handshake, but it MUST  
NOT disclose a username and password until it has fully validated the  
server certificate."

It will be included in the -06 version. I'll probably wait until next week  
with that one, since I released -05 earlier today.

> In section 2.2, "A server that receive a client hello" should be
> "A server that receives a client hello".  Later,

This has already been fixed in the -05 version.

> "require trust in the server, and the server certificate has not been"
> reads better without the comma.

I am not sure about this one. The original version was without the comma,  
but I asked a former colleague (a document writer/reviewer) to review that  
update, and she suggested the comma.

-- 
Sincerely,
Yngve N. Pettersen

Using Opera's mail client: http://www.opera.com/mail/