IETF Logo Mail Archive

Re: [TLS] draft-turner-ssl-must-not

Yoav Nir <ynir@checkpoint.com> Tue, 06 July 2010 07:29 UTC

Return-Path: <ynir@checkpoint.com>
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F023F3A6905 for <tls@core3.amsl.com>; Tue, 6 Jul 2010 00:29:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.299
X-Spam-Level:
X-Spam-Status: No, score=-1.299 tagged_above=-999 required=5 tests=[AWL=1.300, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lMCjvAV08GyZ for <tls@core3.amsl.com>; Tue, 6 Jul 2010 00:29:21 -0700 (PDT)
Received: from michael.checkpoint.com (smtp.checkpoint.com [194.29.34.68]) by core3.amsl.com (Postfix) with ESMTP id 753CC3A68E8 for <tls@ietf.org>; Tue, 6 Jul 2010 00:29:21 -0700 (PDT)
X-CheckPoint: {4C32E800-0-1B221DC2-2FFFF}
Received: from il-ex01.ad.checkpoint.com (il-ex01.checkpoint.com [194.29.34.26]) by michael.checkpoint.com (8.12.10+Sun/8.12.10) with ESMTP id o667SuDq023495; Tue, 6 Jul 2010 10:28:56 +0300 (IDT)
Received: from il-ex01.ad.checkpoint.com ([126.0.0.2]) by il-ex01.ad.checkpoint.com ([126.0.0.2]) with mapi; Tue, 6 Jul 2010 10:29:27 +0300
From: Yoav Nir <ynir@checkpoint.com>
To: Peter Gutmann <pgut001@cs.auckland.ac.nz>
Date: Tue, 06 Jul 2010 10:28:54 +0300
Thread-Topic: [TLS] draft-turner-ssl-must-not
Thread-Index: Acsc3Padk0DlHkMRRgiPmwPaZroF6w==
Message-ID: <04D423AB-178C-45D9-9C5B-D3F24CC31EA4@checkpoint.com>
References: <E1OVy4e-0004g9-ED@wintermute02.cs.auckland.ac.nz>
In-Reply-To: <E1OVy4e-0004g9-ED@wintermute02.cs.auckland.ac.nz>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] draft-turner-ssl-must-not
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 06 Jul 2010 07:29:24 -0000

On Jul 6, 2010, at 5:39 AM, Peter Gutmann wrote:

> Martin Rex <mrex@sap.com> writes:
> 
>> Personally, I dislike the extreme truncation of the Finished messages in TLS
>> to 12 octets.
> 
> But if we didn't use exactly 96 bits for this then the IPsec cargo cult gods
> might smite us!

No, we won't. We've come around. In RFC 4868 we allow up to 256 bits for integrity validation, as long as you're using algorithms that we like.

v2.23.0 | Report a Bug | By Email