IETF Logo Mail Archive

Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

Bodo Moeller <bmoeller@acm.org> Fri, 26 September 2014 07:34 UTC

Return-Path: <SRS0=QEdY=6T=acm.org=bmoeller@srs.kundenserver.de>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F2A011A1A75 for <tls@ietfa.amsl.com>; Fri, 26 Sep 2014 00:34:50 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.714
X-Spam-Level:
X-Spam-Status: No, score=-1.714 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HELO_EQ_DE=0.35, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.786, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qpv9mEvDD714 for <tls@ietfa.amsl.com>; Fri, 26 Sep 2014 00:34:50 -0700 (PDT)
Received: from mout.kundenserver.de (mout.kundenserver.de [212.227.17.24]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D70BF1A1A6E for <tls@ietf.org>; Fri, 26 Sep 2014 00:34:49 -0700 (PDT)
Received: from mail-yh0-f47.google.com (mail-yh0-f47.google.com [209.85.213.47]) by mrelayeu.kundenserver.de (node=mreue103) with ESMTP (Nemesis) id 0LiWYm-1Y7rKd1I1E-00cewW; Fri, 26 Sep 2014 09:34:47 +0200
Received: by mail-yh0-f47.google.com with SMTP id 29so100478yhl.34 for <tls@ietf.org>; Fri, 26 Sep 2014 00:34:46 -0700 (PDT)
MIME-Version: 1.0
X-Received: by 10.236.3.8 with SMTP id 8mr23651393yhg.3.1411716886400; Fri, 26 Sep 2014 00:34:46 -0700 (PDT)
Received: by 10.170.194.15 with HTTP; Fri, 26 Sep 2014 00:34:46 -0700 (PDT)
In-Reply-To: <CABkgnnU8DyzRvvq1e24bUsZdwx48mFOC6KstZaUCbvyQ-WwesQ@mail.gmail.com>
References: <2112FCAD-4820-49D9-9871-6501C83A554D@cisco.com> <CABkgnnUxeouqDNhYFGDC2xqUaT8r7zFvAT5U1OUGJwHwCOuOwA@mail.gmail.com> <CADMpkcJKJiTCQXdDbepyiAf22J9VC03DDgiE521n3NsNnFmALA@mail.gmail.com> <CABkgnnWo9KGMkRrmA0wkJ5Dfnzh2Vo-cveCe_UeH71F8K_4oWw@mail.gmail.com> <CADMpkcJpHeKGV-xc4Uon8KWj=+p=6nQO1_rxb6sRN04nFX--gQ@mail.gmail.com> <CABkgnnU8DyzRvvq1e24bUsZdwx48mFOC6KstZaUCbvyQ-WwesQ@mail.gmail.com>
Date: Fri, 26 Sep 2014 09:34:46 +0200
Message-ID: <CADMpkc+wXf=SG3=C==SV77YXZdbXnbXspJLRZ1UORPF-WbVMEw@mail.gmail.com>
From: Bodo Moeller <bmoeller@acm.org>
To: Martin Thomson <martin.thomson@gmail.com>
Content-Type: multipart/alternative; boundary="001a113676268997ba0503f2f3de"
X-Provags-ID: V02:K0:q3Ob0f/R0BnwHso4xzpEFsdQz5pZeVF8FnrKNbgrixE zwO+8CBeBUCEqiIL8czFJacwRVoDgFsT5uC1CW00lG552hSXie WVDnwoppmIl82GkhUCCFGR2bybY27bSOKn94tI9K60AZNM6Wse qXRWmkVDjKMZtyg8zMYJUrWh+eqJoGcvZC3nI1pUTa/P0FmE1/ WflIWXt3QSufkTPaljAvr6bcYuA+gaeKibB0KAI8iFIzD3+Gby YwSPPPS001kX7g/ox9bvzKAPkr2Xx0EarpkI5UW8mFRLfE2BIt 1d5gCeaLwzS292i2OYTCwdhu8jxmyUdkA8Qai0d19G9NTmX5FI 4sj9gmiZppKdokhsbB3vmwdDmDmXgo9MBK/ZNVDyHZCTT6UPFJ e6HGmx4HjuYJKswHcy+AzmgcHPipe7Hf8TdPtQFPmxe94kaCf/ uizJV
X-UI-Out-Filterresults: notjunk:1;
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/-DlROXpfOPloQCbwc50uTnMHgEk
Cc: "<tls@ietf.org>" <tls@ietf.org>
Subject: Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 26 Sep 2014 07:34:51 -0000

>
> I'm OK with that, but if this is the real reason for the MUST, then
> it's not particularly clear.
>

Hm, maybe so. I can add a brief note showing how the handshake would fail
if the server acts on the SCSV in this case, but I don't think the document
should have to explain why we require the client to omit the SCSV rather
than having the server ignore it. (Why would you want to send it if nothing
follows from that?)

Bodo

v2.23.0 | Report a Bug | By Email