IETF Logo Mail Archive

Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

Bodo Moeller <bmoeller@acm.org> Mon, 20 October 2014 12:51 UTC

Return-Path: <SRS0=BZpw=7L=acm.org=bmoeller@srs.kundenserver.de>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A8581A871E for <tls@ietfa.amsl.com>; Mon, 20 Oct 2014 05:51:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.638
X-Spam-Level:
X-Spam-Status: No, score=-0.638 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HELO_EQ_DE=0.35, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pfv2p-QIDN51 for <tls@ietfa.amsl.com>; Mon, 20 Oct 2014 05:51:57 -0700 (PDT)
Received: from mout.kundenserver.de (mout.kundenserver.de [212.227.126.131]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E77E91A870B for <tls@ietf.org>; Mon, 20 Oct 2014 05:51:56 -0700 (PDT)
Received: from mail-yh0-f41.google.com (mail-yh0-f41.google.com [209.85.213.41]) by mrelayeu.kundenserver.de (node=mreue007) with ESMTP (Nemesis) id 0LbTPL-1YQqyv3Bu7-00lCiI; Mon, 20 Oct 2014 14:51:55 +0200
Received: by mail-yh0-f41.google.com with SMTP id i57so3083761yha.28 for <tls@ietf.org>; Mon, 20 Oct 2014 05:51:52 -0700 (PDT)
MIME-Version: 1.0
X-Received: by 10.236.110.35 with SMTP id t23mr4375743yhg.126.1413809512557; Mon, 20 Oct 2014 05:51:52 -0700 (PDT)
Received: by 10.170.194.15 with HTTP; Mon, 20 Oct 2014 05:51:52 -0700 (PDT)
In-Reply-To: <54450068.5020101@polarssl.org>
References: <2112FCAD-4820-49D9-9871-6501C83A554D@cisco.com> <54450068.5020101@polarssl.org>
Date: Mon, 20 Oct 2014 14:51:52 +0200
Message-ID: <CADMpkcJkiGX3oyV6tmHgZoc1skPJOfoakxE37Tyspn3qvSSCMQ@mail.gmail.com>
From: Bodo Moeller <bmoeller@acm.org>
To: Manuel Pégourié-Gonnard <mpg@polarssl.org>
Content-Type: multipart/alternative; boundary="001a1133358ac6b62a0505da2dc9"
X-Provags-ID: V02:K0:GcNap0wpQmlUmPbIPpG4tg0QLLF8JcLwvmF5baIWCYL DyF9qW8B9Ao4aMUdGZpahp1W87Kn3EWTGybu3KbRaVjbDfagzG BJq3mqi7+Rt46/tLSlQssFpBWG0iWPtoBDZcIX72b+llv/DviN z8M7WMaCxBvdJClMt55ztUdQkk1DZZpE2n4E7mLf9C4Cg6koes YRbzMaJb30EJBrZnk4lCcqdO5fj5NmtxsO3KS7m3yLBQYVvqWi tnYGr4feRbxtz/yJE80C0vLftRaDAsMO+3Z8iWcctXz8jgXeky RWGEMb48ygzkp1K1AFOKDGrx5pUw3/+kJRFXq95vAUyG+57Ix5 nMVQLWbjSCySontFfp3iLJYOU0oGX2nHE8lRI6XsRrDTspcLOT GfW8oGotIBjG2OHUf1g1lgYn6Wl6ChI7y2W3Wtx1eRY24vadlZ 33APw
X-UI-Out-Filterresults: notjunk:1;
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/C2XOrgnYk11cUPxX7_jyzZqj2Po
Cc: "Joseph Salowey (jsalowey)" <jsalowey@cisco.com>, "<tls@ietf.org>" <tls@ietf.org>
Subject: Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 20 Oct 2014 12:51:58 -0000

Manuel Pégourié-Gonnard <mpg@polarssl.org>:

> On 26/09/2014 06:00, Joseph Salowey (jsalowey) wrote:
>


> > This is an announcement for the working group last call for
> > draft-ietf-tls-downgrade-scsv-00.  Please review the document and send
> your
> > comments to the list by Friday, October 17, 2014.
>


> Just to mention that I just implemented this. As expected (since it's one
> of the
> design goals of the draft), it was very easy.
>
> The only problem I ran into was an interop issue with OpenSSL, which
> apparently
> does not like it if the SCSV appears before the actual ciphersuites in the
> ciphersuite list. If the intention of the draft was that the SCSV MUST be
> placed
> after the actual ciphersuites, it would be good to state so using normative
> language, rather than the current one which doesn't look normative:


This is not meant to be normative -- it's a bug in OpenSSL's server-side
code. [If ClientHello.cipher_suites includes TLS_FALLBACK_SCSV, all
following cipher suites are ignored by the server. This will be fixed in
the next release.]

Bodo

v2.45.0 | Report a Bug | By Email | System Status