IETF Logo Mail Archive

Re: [TLS] draft-turner-ssl-must-not

Peter Gutmann <pgut001@cs.auckland.ac.nz> Tue, 06 July 2010 03:32 UTC

Return-Path: <pgut001@cs.auckland.ac.nz>
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1571D3A6A10 for <tls@core3.amsl.com>; Mon, 5 Jul 2010 20:32:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PWyDdI6ht7Vb for <tls@core3.amsl.com>; Mon, 5 Jul 2010 20:32:23 -0700 (PDT)
Received: from mx2-int.auckland.ac.nz (mx2-int.auckland.ac.nz [130.216.12.41]) by core3.amsl.com (Postfix) with ESMTP id 5FCD83A69FF for <tls@ietf.org>; Mon, 5 Jul 2010 20:32:22 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=pgut001@cs.auckland.ac.nz; q=dns/txt; s=uoa; t=1278387146; x=1309923146; h=from:to:subject:cc:in-reply-to:message-id:date; z=From:=20Peter=20Gutmann=20<pgut001@cs.auckland.ac.nz> |To:=20marsh@xs01.extendedsubset.com,=20pgut001@cs.auckla nd.ac.nz|Subject:=20Re:=20[TLS]=20draft-turner-ssl-must-n ot|Cc:=20mrex@sap.com,=20tls@ietf.org|In-Reply-To:=20<201 00706030455.GA31051@xs01.extendedsubset.com>|Message-Id: =20<E1OVysa-00056x-6r@wintermute02.cs.auckland.ac.nz> |Date:=20Tue,=2006=20Jul=202010=2015:31:28=20+1200; bh=N1FBT5JArujzX/myCxYVJeWj0lNmmI4lFKRzyS4wJ8Y=; b=PTqRnVxMPqierBgvqnpFyXp6KS/PcA7EBy9/7E+HTJ6fRz/dfhj2SHA7 UOwRHdTOWHAacx0+bHCWl6ifHP/cDqDkAe3uCokiajr9HYUm0qYo2GjGE derHC+tZejtWZo/O9LS4KLPXSZ6A0VBRDtd7Cwwy2aWXtnDasJ5B70f+W 4=;
X-IronPort-AV: E=Sophos;i="4.53,544,1272801600"; d="scan'208";a="14009948"
X-Ironport-HAT: UNIVERSITY - $RELAY-THROTTLE
X-Ironport-Source: 130.216.207.92 - Outgoing - Outgoing
Received: from wintermute02.cs.auckland.ac.nz ([130.216.207.92]) by mx2-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 06 Jul 2010 15:31:28 +1200
Received: from pgut001 by wintermute02.cs.auckland.ac.nz with local (Exim 4.69) (envelope-from <pgut001@cs.auckland.ac.nz>) id 1OVysa-00056x-6r; Tue, 06 Jul 2010 15:31:28 +1200
From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: marsh@xs01.extendedsubset.com, pgut001@cs.auckland.ac.nz
In-Reply-To: <20100706030455.GA31051@xs01.extendedsubset.com>
Message-Id: <E1OVysa-00056x-6r@wintermute02.cs.auckland.ac.nz>
Date: Tue, 06 Jul 2010 15:31:28 +1200
Cc: tls@ietf.org
Subject: Re: [TLS] draft-turner-ssl-must-not
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 06 Jul 2010 03:32:25 -0000

Marsh Ray <marsh@xs01.extendedsubset.com> writes:
>On Tue, Jul 06, 2010 at 02:39:52PM +1200, Peter Gutmann wrote:
>> Martin Rex <mrex@sap.com> writes:
>>
>> >Personally, I dislike the extreme truncation of the Finished messages in TLS
>> >to 12 octets.
>>
>> But if we didn't use exactly 96 bits for this then the IPsec cargo cult gods
>> might smite us!
>
>Is that where that came from, IPsec?

In IPsec there were exactly 96 bits left in a (evenly-sized) packet for a 24- 
byte AH header (to fit the IPv6 8-byte quantisation) so they decided to 
truncate the MAC value to fit it.

Since then, cargo cult design has seen it adopted in TLS, in SSH, in SNMP, in
RADIUS, in iSCSI, in Kerberos, in Gigabeam, in HIP, heck I bet there's a
standards group trying to put it into DHCP somewhere... rot bilong kago.

Peter.

v2.23.0 | Report a Bug | By Email