IETF Logo Mail Archive

Re: [TLS] TLS or HTTP issue? (was: TLS renegotiation issue)

Nicolas Williams <Nicolas.Williams@sun.com> Fri, 06 November 2009 17:42 UTC

Return-Path: <Nicolas.Williams@sun.com>
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D38573A67EA for <tls@core3.amsl.com>; Fri, 6 Nov 2009 09:42:02 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.017
X-Spam-Level:
X-Spam-Status: No, score=-6.017 tagged_above=-999 required=5 tests=[AWL=0.029, BAYES_00=-2.599, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eU6gc006Zin9 for <tls@core3.amsl.com>; Fri, 6 Nov 2009 09:42:02 -0800 (PST)
Received: from brmea-mail-1.sun.com (brmea-mail-1.Sun.COM [192.18.98.31]) by core3.amsl.com (Postfix) with ESMTP id 147373A6768 for <tls@ietf.org>; Fri, 6 Nov 2009 09:42:01 -0800 (PST)
Received: from dm-central-02.central.sun.com ([129.147.62.5]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id nA6HgPDY002513 for <tls@ietf.org>; Fri, 6 Nov 2009 17:42:25 GMT
Received: from binky.Central.Sun.COM (binky.Central.Sun.COM [129.153.128.104]) by dm-central-02.central.sun.com (8.13.8+Sun/8.13.8/ENSMAIL, v2.2) with ESMTP id nA6HgOCi025889 for <tls@ietf.org>; Fri, 6 Nov 2009 10:42:25 -0700 (MST)
Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id nA6HNOWL010198; Fri, 6 Nov 2009 11:23:24 -0600 (CST)
Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id nA6HNN85010197; Fri, 6 Nov 2009 11:23:23 -0600 (CST)
X-Authentication-Warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f
Date: Fri, 06 Nov 2009 11:23:23 -0600
From: Nicolas Williams <Nicolas.Williams@sun.com>
To: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Message-ID: <20091106172323.GY1105@Sun.COM>
References: <73843DF9-EFCB-4B8D-913E-FE2235E5BDD3@rtfm.com> <4AF33D07.7040100@gnutls.org>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <4AF33D07.7040100@gnutls.org>
User-Agent: Mutt/1.5.7i
Cc: Eric Rescorla <ekr@rtfm.com>, "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] TLS or HTTP issue? (was: TLS renegotiation issue)
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 06 Nov 2009 17:42:02 -0000

This vulnerability will affect different application protocols
differently.  It certainly affects HTTP.  I think LDAP may not be
susceptible, but I'm not sure; I'm even less sure about IMAP.  Others
have indicated that there definitely exist other applications besides
HTTP which do suffer from this vulnerability though, and that's the key:
of course there may be more than one application protocol that is made
vulnerable by this TLS problem.

We must fix this problem in TLS itself.  The fix may require changes to
some applications, depending not so much on the protocol as on the TLS
API used.

Nico
--

v2.23.0 | Report a Bug | By Email