IETF Logo Mail Archive

Re: [TLS] TLS 1.3 - Support for compression to be removed

Dave Garrett <davemgarrett@gmail.com> Tue, 22 September 2015 18:23 UTC

Return-Path: <davemgarrett@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D20441ABD8F for <tls@ietfa.amsl.com>; Tue, 22 Sep 2015 11:23:54 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k1FTC7QHdUIq for <tls@ietfa.amsl.com>; Tue, 22 Sep 2015 11:23:53 -0700 (PDT)
Received: from mail-yk0-x22f.google.com (mail-yk0-x22f.google.com [IPv6:2607:f8b0:4002:c07::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1482F1ABD3A for <tls@ietf.org>; Tue, 22 Sep 2015 11:23:40 -0700 (PDT)
Received: by ykdg206 with SMTP id g206so18230194ykd.1 for <tls@ietf.org>; Tue, 22 Sep 2015 11:23:39 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:subject:date:user-agent:cc:references:in-reply-to :mime-version:content-type:content-transfer-encoding:message-id; bh=Up934BlJf9VMn5CxfyFgyPYV/xg31vEdP5koBAzrx4Q=; b=bv/QWFhiE2zlaSRDt+qcRHg7z2aPlh4KiYlPwHnzb5NhDcl9+5vCbjBQ2J5GL9rswh kK7I5YsHFI6ZD8Ua19Xq0M98IxcT2agx3JrkZh4KS/cpbivwt5hOvxP+Z7rVOa37LglU D7OdDF1f7H4jn6I7mE0H78svVu/og5UtW1wESdcnxq9E+BVOp0V6Y+3zv4OUHEWEqz1J gikpYU0CAYqWKXdhvHMo4OEbFnR5FKBtVm0B4ynXbQrR25Mju95uxdiGXBwqtDdwCITt SEgPwWzRff9fqBjJ3TvE3IWVFVyka5oElzZeVFkr+rUmMZImVgN07oHOQrqCVIxIz2Gn laZQ==
X-Received: by 10.13.243.4 with SMTP id c4mr23459494ywf.12.1442946219396; Tue, 22 Sep 2015 11:23:39 -0700 (PDT)
Received: from dave-laptop.localnet (pool-72-94-152-197.phlapa.fios.verizon.net. [72.94.152.197]) by smtp.gmail.com with ESMTPSA id q2sm1666297ywd.11.2015.09.22.11.23.38 (version=TLSv1 cipher=RC4-SHA bits=128/128); Tue, 22 Sep 2015 11:23:38 -0700 (PDT)
From: Dave Garrett <davemgarrett@gmail.com>
To: tls@ietf.org
Date: Tue, 22 Sep 2015 14:23:37 -0400
User-Agent: KMail/1.13.5 (Linux/2.6.32-74-generic-pae; KDE/4.4.5; i686; ; )
References: <20150922132321.17789008.2591.24358@ll.mit.edu> <CAHOTMV+riEzyYQcDfh4mMRokivCD_6T=ErTKF+BP41xABWEG8A@mail.gmail.com> <56019B0F.3020208@trigofacile.com>
In-Reply-To: <56019B0F.3020208@trigofacile.com>
MIME-Version: 1.0
Content-Type: Text/Plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Message-Id: <201509221423.38061.davemgarrett@gmail.com>
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/BYfq8THDyE_KYpGtBy6Vtvdql2w>
Subject: Re: [TLS] TLS 1.3 - Support for compression to be removed
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Sep 2015 18:23:55 -0000

On Tuesday, September 22, 2015 02:16:47 pm Julien ÉLIE wrote:
> Regarding vulnerable protocols, clients (and/or servers) could very well 
> disable compression in TLS.  And either never use compression or 
> implement their own compression, according to their needs.
> It is what happened with BEAST:  Firefox and Chrome disabled TLS 
> compression.

No sane security protocol should allow any mode which is known to be insecure under its common use-case. TLS 1.2 is technically configurable in a secure manner, but hardly anyone does so correctly. With TLS 1.3, we need to get rid of all of the insecure modes so all configurations are secure (at least to start).


Dave

v2.23.0 | Report a Bug | By Email