Re: [TLS] Analysis of Interop scenarios TLS extension RI w/MCSV

[Martin Rex <[e-mail]>]

Nelson B Bolyard wrote:
> 
> > Keeping an old version of a specification around in a MUCH
> > MORE promentiently fashion for 9 years tells a lot about what
> > Netscape thought of the draft-302.txt document.
> 
> It's not "much more prominent".  It's merely HTML.  Prettier, perhaps.


Let's see:

The following URL says "SPEC":
http://web.archive.org/web/20050207004652/wp.netscape.com/eng/ssl3/3-SPEC.HTM

This URL says "Draft":
http://web.archive.org/web/20050206122938/wp.netscape.com/eng/ssl3/draft302.txt

and includes an _explicit_ expiration of May 1997.


And concerning extensibility of SSLv3, here's a statement
from Tom Weinstein, listed in the Authors section of the
Nov 18th, 1996 draft as a Netscape employee from
10-Oct-1996:

http://www.imc.org/ietf-tls/mail-archive/msg00325.html

  The lack of a general extension mechanism in SSL v3 is a feature, not a
  bug.  This is a security protocol, and so susceptibility to analysis is
  a good thing.  Simplicity and rigidity are features here.  SSL does
  provide for forwards compatibility by allowing version negotiation and
  protection from version rollback attacks.

  -Tom Weinstein, Netscape, 10-Oct-1996, Co-Author of draft302.txt


So as far as Netscape's SSLv3 is concerned it didn't not contain
extensibility.  What is in that November draft is something the
TLS WG wanted for TLSv1.0.

Keep in mind that in mid of 1996, SSLv3 was not under development,
it was already widely deployed.


> 
> It amuses me that you tell me what Netscape did and didn't do with those
> pages, because *I* was the Netscape employee who maintained that section
> of the web site from 1998-2005, beginning when I implemented TLS 1.0
> in Netscape's NSS.

You could have removed the explicit expiration notice on draft302.txt
and you could have renamed it to "3.0 final SPEC", you could have
removed the version that you condered outdated--or at least clearly
marked it as outdated _in_the_document_ if that was what you or
Netscape intended it to be.


-Martin