[TLS] wrt -ssl-must-not and -tls-server-id-check

=JeffH <Jeff.Hodges@KingsMountain.com> Wed, 04 August 2010 01:55 UTC

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=kingsmountain.com; h=Received:Message-ID:Date:From:User-Agent:MIME-Version:To:Subject:Content-Type:Content-Transfer-Encoding:X-Identified-User; b=PoUGUXJ8d+NLWXLQfuCVp20VNx8jiuh9tiWvJ7t9VCsoINDJrmDT/uB3BPDVDJPXQ9GDMwAM4+qF9cjh8NTY/ealgBUHWehPB05xL7OPVI7Zklf0e0ARlKQASXI+QnCs;
Message-ID: <4C58C8C2.8020403@KingsMountain.com>
Date: Tue, 03 Aug 2010 18:56:18 -0700
From: =JeffH <Jeff.Hodges@KingsMountain.com>
User-Agent: Thunderbird 2.0.0.24 (X11/20100411)
MIME-Version: 1.0
To: IETF TLS WG <tls@ietf.org>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Subject: [TLS] wrt -ssl-must-not and -tls-server-id-check
Precedence: list

One of my take-aways from the TLS wg session last week in Maastricht (ietf-78) 
was that wrt draft-turner-ssl-must-not, the sense in the room was that it will 
be ok to deprecate SSLv2 and earlier, but not SSLv3.

That said, it occurs to me that we should perhaps add an item to the Scope 
section of -tls-server-id-check 
<http://tools.ietf.org/html/draft-saintandre-tls-server-id-check> that the 
requirements described therein apply to SSL certs as well as TLS. Part of the 
rationale being that many people refer to (and seem to regard) both protocols 
as essentially the same (i.e. they are differentiated to end users only on a 
buried advanced preferences dialog) and many use the term "SSL" to refer to 
both TLS and SSL, and thus we should perhaps explicitly mention SSL once in 
terms of scope in order to try to be clear about applicability (and help the 
spec turn up appropriately in search engine results :)

thoughts?

thanks,

=JeffH

[TLS] wrt -ssl-must-not and -tls-server-id-check =JeffH