Re: [TLS] A la carte handshake negotiation

Dave Garrett <davemgarrett@gmail.com> Fri, 12 June 2015 15:23 UTC

Return-Path: <davemgarrett@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF4341A00E7 for <tls@ietfa.amsl.com>; Fri, 12 Jun 2015 08:23:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lHmEu3kMmbaD for <tls@ietfa.amsl.com>; Fri, 12 Jun 2015 08:23:02 -0700 (PDT)
Received: from mail-qg0-x236.google.com (mail-qg0-x236.google.com [IPv6:2607:f8b0:400d:c04::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8DD821A0052 for <tls@ietf.org>; Fri, 12 Jun 2015 08:23:02 -0700 (PDT)
Received: by qgep100 with SMTP id p100so12502299qge.3 for <tls@ietf.org>; Fri, 12 Jun 2015 08:23:01 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:subject:date:user-agent:cc:references:in-reply-to :mime-version:content-type:content-transfer-encoding:message-id; bh=BN4lyK87TMdu/+G8xGZTec4/j2yVDjVtUUBdnM4n5YQ=; b=x/WKfhLdMShaFH9VfFPu6EWPLJa2Nm70qxT+0ydrLtg2IM9vBTc+UPlBIwpXHa3+Gp r25JyO5m/LBOX507bKmumUUeeiWfniNIgVdXPSsUhVk/Hb1MTwPZ4PJ4Hg94LOMqoP4y 0NrVBvowt/v89PZ+wFGdIl23u6eBj+h11vGKatmkliArQIHDiR+foEPpgyRxwI4TEYzg tz3Hipp+BHDfcInP7Qs79JL+CLPf2ojQrfQk0k7sloC3LmBTnpiMTQg9vm7OZ9OGaA88 AhgfAXbZORb0rgRr2OYBhVx7Zi0yjmK4dp8lFr9N7LA3WdvQTZFky/TNFSu/gvbQadkF FcoQ==
X-Received: by 10.140.95.204 with SMTP id i70mr18643985qge.51.1434122581881; Fri, 12 Jun 2015 08:23:01 -0700 (PDT)
Received: from dave-laptop.localnet (pool-96-245-254-195.phlapa.fios.verizon.net. [96.245.254.195]) by mx.google.com with ESMTPSA id 139sm1780484qhx.22.2015.06.12.08.23.01 (version=TLSv1 cipher=RC4-SHA bits=128/128); Fri, 12 Jun 2015 08:23:01 -0700 (PDT)
From: Dave Garrett <davemgarrett@gmail.com>
To: Ilari Liusvaara <ilari.liusvaara@elisanet.fi>
Date: Fri, 12 Jun 2015 11:23:00 -0400
User-Agent: KMail/1.13.5 (Linux/2.6.32-74-generic-pae; KDE/4.4.5; i686; ; )
References: <201506111558.21577.davemgarrett@gmail.com> <20150612083153.GA24990@LK-Perkele-VII>
In-Reply-To: <20150612083153.GA24990@LK-Perkele-VII>
MIME-Version: 1.0
Content-Type: Text/Plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Message-Id: <201506121123.00732.davemgarrett@gmail.com>
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/5bZwVzUNi5IJAgBBS7VNJI_gXpA>
Cc: "<tls@ietf.org>" <tls@ietf.org>
Subject: Re: [TLS] A la carte handshake negotiation
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 12 Jun 2015 15:23:04 -0000

On Friday, June 12, 2015 04:31:53 am Ilari Liusvaara wrote:
> On Thu, Jun 11, 2015 at 03:58:21PM -0400, Dave Garrett wrote:
> > 6) No more confusing double negotiation of signature algorithms. Just extensions, instead of many suites and extensions.
> 
> Also, there is no "double negotiation" in TLS 1.2 either. TLS 1.2 is
> quite clear about interaction of signature algorithms in ciphersuites
> and explicit signature negotiation (explicit negotiation always takes
> percedence).

One of the two takes precedence, yes, but there's still two.

> Of course, I wouldn't be surprised if there was fair bit of software
> that got those rules wrong...

I'd be surprised if there wasn't. :/


Dave