Re: [TLS] Rizzo claims implementation attach, should be interesting

Nico Williams <nico@cryptonector.com> Wed, 21 September 2011 02:23 UTC

Return-Path: <nico@cryptonector.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB67C21F8C61 for <tls@ietfa.amsl.com>; Tue, 20 Sep 2011 19:23:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.661
X-Spam-Level:
X-Spam-Status: No, score=-2.661 tagged_above=-999 required=5 tests=[AWL=-0.684, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Hm2SHcbCr1TU for <tls@ietfa.amsl.com>; Tue, 20 Sep 2011 19:23:46 -0700 (PDT)
Received: from homiemail-a32.g.dreamhost.com (caiajhbdcahe.dreamhost.com [208.97.132.74]) by ietfa.amsl.com (Postfix) with ESMTP id 6312721F8C5F for <tls@ietf.org>; Tue, 20 Sep 2011 19:23:46 -0700 (PDT)
Received: from homiemail-a32.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a32.g.dreamhost.com (Postfix) with ESMTP id C629F584058 for <tls@ietf.org>; Tue, 20 Sep 2011 19:26:13 -0700 (PDT)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=cryptonector.com; h=mime-version :in-reply-to:references:date:message-id:subject:from:to:cc: content-type; q=dns; s=cryptonector.com; b=D6AzPQpKRbO6sSwHeZusk PC/KG3g3iBVuI5Yk2NkvDTOzvmnlHOZDUDhQPhtpqlzjudfOHvF82EQrwKAsIAII jE73Ufhu24bbptcWLC1lanbfr1lOEIurZe+whuLQx32aJonhEG+f5eR0+XLlwzy+ t0vN8E5jL9inbnJJKxTUOo=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=cryptonector.com; h= mime-version:in-reply-to:references:date:message-id:subject:from :to:cc:content-type; s=cryptonector.com; bh=mfiblHlPZYCzgWRBS6OY jCTCHmw=; b=LOHFz3E53ril8c6Qpk6MiV/xZWphOD2X2UED1yMbcI0nAneWVIeZ 6C278nXwk20BMY/bF+Y4qXDee7OMJas/2bWu4ByoaYh7UvnAE1VZqGiKHYQIisRi YiEAfMvkjwCaPuw/okzuAWiCNi+zC9sN/cKEiOla3joSAMlNhgRuzPg=
Received: from mail-yx0-f172.google.com (mail-yx0-f172.google.com [209.85.213.172]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: nico@cryptonector.com) by homiemail-a32.g.dreamhost.com (Postfix) with ESMTPSA id 9F94B584057 for <tls@ietf.org>; Tue, 20 Sep 2011 19:26:13 -0700 (PDT)
Received: by yxt33 with SMTP id 33so1007329yxt.31 for <tls@ietf.org>; Tue, 20 Sep 2011 19:26:13 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.68.46.101 with SMTP id u5mr562453pbm.332.1316571972638; Tue, 20 Sep 2011 19:26:12 -0700 (PDT)
Received: by 10.68.60.4 with HTTP; Tue, 20 Sep 2011 19:26:12 -0700 (PDT)
In-Reply-To: <201109210010.p8L0AOMB003130@fs4113.wdf.sap.corp>
References: <CAK3OfOhBcrRG6AanVmqmXtXoZcPA5s0iyXH5bu2r2TrnUg4egA@mail.gmail.com> <201109210010.p8L0AOMB003130@fs4113.wdf.sap.corp>
Date: Tue, 20 Sep 2011 21:26:12 -0500
Message-ID: <CAK3OfOixjaUx-njyDkuqiDZYd_H+XTMj5zTo9DhEgEAB6O7thg@mail.gmail.com>
From: Nico Williams <nico@cryptonector.com>
To: mrex@sap.com
Content-Type: text/plain; charset="UTF-8"
Cc: asteingruebl@paypal-inc.com, tls@ietf.org
Subject: Re: [TLS] Rizzo claims implementation attach, should be interesting
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 21 Sep 2011 02:23:47 -0000

On Tue, Sep 20, 2011 at 7:10 PM, Martin Rex <mrex@sap.com> wrote:
> Nico Williams wrote:
>> Martin Rex wrote:
>> Undocumented design limitations are not obvious, even if in retrospect
>> they should have been.
>
> You seem to be approaching the issue from the wrong end.

As if I was at fault.  Or as if saying any of this could undo what happened.

Did SSLv2, v3, TLS 1.0, say anything that would have caused others to
realize that it was not a good choice of technology for IMAP, or to
notice that JavaScript in browsers was a recipe for disaster?  RFC2246
doesn't say anything about this: section F outlines the threat model
and says nothing about carrying untrusted content, but that's hardly
dispositive.

Nico
--