Re: [TLS] TLS, PKI, and web security. Was: Eleven out of every ten SSL certs aren't valid

[Peter Gutmann <[e-mail]>]

Marsh Ray <[e-mail]> writes:

>1. Is TLS an effective and secure cryptographic protocol primitive? Does it
>deliver on the stated and implied guarantees given by its RFCs?

This is an interesting issue, I'm not sure if there actually is any document
that covers the TLS threat model apart from Ian Grigg's wonderful definition
of the "the threat model is whatever the protocol is capable of defending
against".  In the DNSSEC case it wasn't until ten years after the initial
DNSSEC RFCs were published that someone sat down and documented what it was
that they were trying to achieve (!!!).  What we'd need here is a clear
statement of what TLS can, and can't, protect against, and under which
circumstances, and in which configurations.  Until we have that baseline to
build on, it's (unfortunately) not really possible to have a meaningful debate
about whether it meets is goals because we don't know if aspect X is a flaw in
TLS, a flaw in something other than TLS, not a flaw at all, or out of scope.
As Bob Morris once said [0], "the behaviour of a program withot a
specification can never be wrong, merely surprising".

Peter.

[0] I'm not certain that he was the person who said this, if anyone knows
    who it was, and where, could they let me know.