IETF Logo Mail Archive

Re: [TLS] Consensus call for keys used in handshake and data messages

Daniel Kahn Gillmor <dkg@fifthhorseman.net> Thu, 16 June 2016 16:13 UTC

Return-Path: <dkg@fifthhorseman.net>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9D4D12D951 for <tls@ietfa.amsl.com>; Thu, 16 Jun 2016 09:13:32 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0OgEX_n4qOVM for <tls@ietfa.amsl.com>; Thu, 16 Jun 2016 09:13:32 -0700 (PDT)
Received: from che.mayfirst.org (che.mayfirst.org [162.247.75.118]) by ietfa.amsl.com (Postfix) with ESMTP id 3ABB812D8EE for <tls@ietf.org>; Thu, 16 Jun 2016 09:13:30 -0700 (PDT)
Received: from fifthhorseman.net (unknown [108.58.6.98]) by che.mayfirst.org (Postfix) with ESMTPSA id 78BC6F98B; Thu, 16 Jun 2016 12:13:28 -0400 (EDT)
Received: by fifthhorseman.net (Postfix, from userid 1000) id 297D61FFC0; Thu, 16 Jun 2016 12:13:28 -0400 (EDT)
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
To: Hubert Kario <hkario@redhat.com>, tls@ietf.org
In-Reply-To: <1853340.Xg5UvgGrF6@pintsize.usersys.redhat.com>
References: <CAOgPGoDRZdJN7DY10tDoEEidVkxeKabCcW_U3vQqaaH6x162gw@mail.gmail.com> <26741B4E-3C0F-4E0C-AB44-F7DFCCEFED53@gmail.com> <871t3y1s99.fsf@alice.fifthhorseman.net> <1853340.Xg5UvgGrF6@pintsize.usersys.redhat.com>
User-Agent: Notmuch/0.22+69~gd812194 (https://notmuchmail.org) Emacs/24.5.1 (x86_64-pc-linux-gnu)
Date: Thu, 16 Jun 2016 12:13:28 -0400
Message-ID: <87mvmlw1qv.fsf@alice.fifthhorseman.net>
MIME-Version: 1.0
Content-Type: text/plain
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/9nN6rGuBpI07ndJK-ADpe4ecSnI>
Subject: Re: [TLS] Consensus call for keys used in handshake and data messages
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 16 Jun 2016 16:13:33 -0000

On Thu 2016-06-16 11:26:14 -0400, Hubert Kario wrote:
> wasn't that rejected because it breaks boxes that do passive monitoring 
> of connections? (and so expect TLS packets on specific ports, killing 
> connection if they don't look like TLS packets)

We're talking about the possibility of changing the TLS record framing
anyway, which would kill the simplest of those boxes.  One theory is if
you're going to make such a break, you might as well pull the band aid
off in one fell swoop.

    --dkg

v2.23.0 | Report a Bug | By Email