Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Date: Thu, 11 Mar 2010 22:07:44 -0800
Message-ID: <AC1CFD94F59A264488DC2BEC3E890DE509CE7E87@xmb-sjc-225.amer.cisco.com>
In-Reply-To: <000201cac08b$882391a0$0601a8c0@allison>
Thread-Topic: [Syslog] DTLS renegotiation
Thread-Index: AcrAlBzKxNxQWz/KSTGI1Y3tdqnNcABFd6jA
References: <AC1CFD94F59A264488DC2BEC3E890DE509C5B96D@xmb-sjc-225.amer.cisco.com>
 <000201cac08b$882391a0$0601a8c0@allison>
From: "Joseph Salowey (jsalowey)" <jsalowey@cisco.com>
To: "tom.petch" <cfinss@dial.pipex.com>, <syslog@ietf.org>
Subject: Re: [Syslog] DTLS renegotiation
Precedence: list

Hi Tom,

The text I suggested is a bit vague.  I like your replacement text.

Joe

> > 8.1 DTLS Renegotiation
> >
> > TLS and DTLS renegotiation may be vulnerable to attacks described in
RFC
> > 5746.  Although RFC 5746 provides a fix for some of the issues,
> > renegotiation can still cause problems for applications since
connection
> > security parameters can change without the application knowing it.
> > There for it is RECOMMENDED that renegotiation be disabled for
syslog
> > over DTLS.   If, for some reason, renegotiation is allowed then the
> > specification in RFC 5746 MUST be followed and the implementation
MUST
> > make sure that the connection security parameters do not change
during
> > renegotiation.
>=20
> I think that the last sentence goes too far and should be more like
>=20
> " If renegotiation is allowed then the
> > specification in RFC 5746 MUST be followed and the implementation
MUST
> > make sure that the connection still has adequate security and that
any
> identities extracted from client and serverthe certificates do not
change
> during
> > renegotiation.
>=20
> Well, a bit clumsy, but I would like to be specific on those two
issues.
> They
> are nothing to do with the problem that RFC5746 addresses but the work
> leading
> up to RFC5746 did show that these are related issues with
renegotiation.
>=20
> Tom Petch
>=20
>=20
> > _______________________________________________
> > Syslog mailing list
> > Syslog@ietf.org
> > https://www.ietf.org/mailman/listinfo/syslog