IETF Logo Mail Archive

Re: [TLS] ban more old crap

Dave Garrett <davemgarrett@gmail.com> Fri, 24 July 2015 16:57 UTC

Return-Path: <davemgarrett@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D6E091ACD2F for <tls@ietfa.amsl.com>; Fri, 24 Jul 2015 09:57:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rHa05jW3A_Nv for <tls@ietfa.amsl.com>; Fri, 24 Jul 2015 09:57:45 -0700 (PDT)
Received: from mail-qg0-x236.google.com (mail-qg0-x236.google.com [IPv6:2607:f8b0:400d:c04::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 817F61ABC75 for <tls@ietf.org>; Fri, 24 Jul 2015 09:57:45 -0700 (PDT)
Received: by qgy5 with SMTP id 5so13319818qgy.3 for <tls@ietf.org>; Fri, 24 Jul 2015 09:57:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:subject:date:user-agent:cc:references:in-reply-to :mime-version:content-type:content-transfer-encoding:message-id; bh=B3QLMh5mwVuKNbPgFQbiH420Tr5foG4/e/IpUu6fESA=; b=rH7AO+qvTPs2mJicMQ5PsZNIKPF57upGaUn0ynVvSYTiak4ATpr9LVVBlHLvuUDAmu OtaLKbFZ/+YDMpBg4cwF+Mo1ja5OYQNieAuZR2/At1TNSIKYOhOfqn4+3kQ56r6+/4LR Xu2LRH0CnynFqprQ58KwowaNWpKTjUwYdWQsPP3hakPuCSBU1GfUbxq4+aSqGvH7KY3i oAsaj0Kza3bYpBUaVlAVT5192fsCIbzxgjFbUT0c98EIQLLqsFZtE1PdutBHtmePh1E7 zO7wBirFYjpmzRwqvzcF214y/l8wpJB2evoje+4dAzIB9UW4rg8v3vR+tkUIkoh1c6x9 uQqw==
X-Received: by 10.140.238.76 with SMTP id j73mr22266599qhc.41.1437757064859; Fri, 24 Jul 2015 09:57:44 -0700 (PDT)
Received: from dave-laptop.localnet (pool-96-245-254-195.phlapa.fios.verizon.net. [96.245.254.195]) by smtp.gmail.com with ESMTPSA id j62sm4294048qhc.33.2015.07.24.09.57.44 (version=TLSv1 cipher=RC4-SHA bits=128/128); Fri, 24 Jul 2015 09:57:44 -0700 (PDT)
From: Dave Garrett <davemgarrett@gmail.com>
To: Hubert Kario <hkario@redhat.com>
Date: Fri, 24 Jul 2015 12:57:42 -0400
User-Agent: KMail/1.13.5 (Linux/2.6.32-74-generic-pae; KDE/4.4.5; i686; ; )
References: <201507221610.27729.davemgarrett@gmail.com> <201507231421.15927.davemgarrett@gmail.com> <2433298.8v8VhukdnX@pintsize.usersys.redhat.com>
In-Reply-To: <2433298.8v8VhukdnX@pintsize.usersys.redhat.com>
MIME-Version: 1.0
Content-Type: Text/Plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Message-Id: <201507241257.43115.davemgarrett@gmail.com>
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/2cri5SMi4MpoGV53ij2eINvUIhg>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] ban more old crap
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 24 Jul 2015 16:57:47 -0000

On Friday, July 24, 2015 06:43:17 am Hubert Kario wrote:
> And I completely agree. FREAK and Logjam wouldn't happen at all if we didn't 
> drag with us stuff that was considered legacy 10 years ago.
> 
> But stuff like "server MUST abort handshake if it sees export grade ciphers in 
> Client Hello" (or anything similar) will just get ignored. For a user a bad 
> connection is better than no connection. One works and the other doesn't, the 
> details are voodoo witchcraft.

To be clear, the wording I have in the PR is not this broad. It only requires aborting if export ciphers were offered by a TLS 1.3+ client, not just any client. The point is to ensure that all TLS 1.3 implementations cut this out and don't regress due to error or exploit. Applying it to everything would, unfortunately, be a mess. In particular, search engine spiders actually have a legitimate reason to have export ciphers actually still enabled.


Dave

v2.23.0 | Report a Bug | By Email