Re: [TLS] SCSV vs RI when both specified. Was: Updated draft

[Michael D'Errico <[e-mail]>]

So what's the consensus on this?

   1) client MUST not send both signals, and a server MUST abort
      if it sees both

or

   2) client MAY send both signals, and the server MUST ignore
      SCSV when RI is present

I prefer (2) since there is no security problem with the client sending
both -- the only problem is the current wording in the spec.  Remember
the spec is currently a DRAFT, and that means it is open to changes!  I
don't understand the reluctance to clarify this.

Mike



[e-mail] wrote:
> Uri Blumenthal wrote:
> 
>> OK. Karlsruhe server time-outs on me, so no chance to get enlightened
>> by checking that thread. Please indulge me: the one short compelling
>> reason why we don't want to say "when two signals are present use this
>> one and ignore the other" instead of "when two signals are present -
>> abort connection" - is...?
> 
> Well, if the spec says "the client MUST not send two signals", then if
> two signals are present, it's probably safer to abort (since the
> client is not following the spec anyway, it's hard to guess
> what its intent was...)
> 
> Best regards,
> Pasi
> (not wearing any hats)