IETF Logo Mail Archive

Re: [TLS] TLS v1.2 performance (was Re: TLSv1.2 with DSA client

Nikos Mavrogiannopoulos <nmav@gnutls.org> Sat, 05 March 2011 08:39 UTC

Return-Path: <n.mavrogiannopoulos@gmail.com>
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E175C3A693D for <tls@core3.amsl.com>; Sat, 5 Mar 2011 00:39:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.69
X-Spam-Level:
X-Spam-Status: No, score=-3.69 tagged_above=-999 required=5 tests=[AWL=-0.091, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ftQKscAnz1cN for <tls@core3.amsl.com>; Sat, 5 Mar 2011 00:39:06 -0800 (PST)
Received: from mail-ey0-f172.google.com (mail-ey0-f172.google.com [209.85.215.172]) by core3.amsl.com (Postfix) with ESMTP id C699E3A6916 for <tls@ietf.org>; Sat, 5 Mar 2011 00:39:05 -0800 (PST)
Received: by eye13 with SMTP id 13so1090624eye.31 for <tls@ietf.org>; Sat, 05 Mar 2011 00:40:15 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:sender:message-id:date:from:user-agent :mime-version:to:subject:references:in-reply-to:x-enigmail-version :openpgp:content-type:content-transfer-encoding; bh=lS8ty8RDgLgpVChaKdlu7ekAgK+li1aUr2hkXS0ynUY=; b=PoxK3LXkclj5OkHen21QGSjbWkm7FCgLVtgP0g8qMDLmGVcB83MnMmqjfothumZGDu DncW4u6Sp//yh1hd/9YZacDxZ2jjr4ksTqv901g5wPjyJ+0ljKgU41yqvYvf5o81Jj3N KBaHiOFd4/vB8WIXtBxisKd+JVXthTavij5/Y=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:subject :references:in-reply-to:x-enigmail-version:openpgp:content-type :content-transfer-encoding; b=qlsbvYp6456vXOBB7IMW4RWzEJDKKKXVdm7Kukhs/RgAJbmJUVNdzY8NM0jF3Nb+A7 BJ4cK8C2dDnhr7yDm4a23BNaHZEJgmpxOrdMDvk7GrNnxU4N3kcePAQGf6WY/yWWpdor c2LDEZvpmKwRRwiOcdwv+SGmI24ZlkK2lv7Ek=
Received: by 10.213.110.208 with SMTP id o16mr267756ebp.0.1299314415432; Sat, 05 Mar 2011 00:40:15 -0800 (PST)
Received: from [10.100.2.14] (78-23-65-69.access.telenet.be [78.23.65.69]) by mx.google.com with ESMTPS id w59sm224140eeh.21.2011.03.05.00.40.13 (version=SSLv3 cipher=OTHER); Sat, 05 Mar 2011 00:40:14 -0800 (PST)
Sender: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
Message-ID: <4D71F6ED.2070100@gnutls.org>
Date: Sat, 05 Mar 2011 09:40:13 +0100
From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101208 Thunderbird/3.1.7
MIME-Version: 1.0
To: tls@ietf.org
References: <E1Pvl9H-0006Ng-Oe@login01.fos.auckland.ac.nz>
In-Reply-To: <E1Pvl9H-0006Ng-Oe@login01.fos.auckland.ac.nz>
X-Enigmail-Version: 1.1.2
OpenPGP: id=96865171
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
Subject: Re: [TLS] TLS v1.2 performance (was Re: TLSv1.2 with DSA client
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 05 Mar 2011 08:39:07 -0000

On 03/05/2011 07:39 AM, Peter Gutmann wrote:
> Martin Rex <mrex@sap.com> writes:
> 
>> It is *MUCH* worse than that.
>> TLSv1.2 goes as far as _requiring_ that if the signature_algorithm extension
>> is sent, that the receiver MUST ensure that all certificates in the chain are
>>from the signature_algorithm set.
>> That is not just shooting yourself in the foot, that is shooting "the whole
>> nine yards" (the entire ammunition belt) in your foot.
> Just out of interest, how are other implemeters dealing with this?  I looked
> at that requirement in the spec, decided it was totally crazy, and ignored it.

Same for gnutls.

regards,
Nikos

v2.23.0 | Report a Bug | By Email