IETF Logo Mail Archive

Re: [TLS] Should we require implementations to send alerts?

Dave Garrett <davemgarrett@gmail.com> Thu, 17 September 2015 22:39 UTC

Return-Path: <davemgarrett@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D6B91A1BF8 for <tls@ietfa.amsl.com>; Thu, 17 Sep 2015 15:39:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mf5mF7Fy4Dud for <tls@ietfa.amsl.com>; Thu, 17 Sep 2015 15:39:07 -0700 (PDT)
Received: from mail-qg0-x232.google.com (mail-qg0-x232.google.com [IPv6:2607:f8b0:400d:c04::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 42EC21A1BF6 for <tls@ietf.org>; Thu, 17 Sep 2015 15:39:07 -0700 (PDT)
Received: by qgev79 with SMTP id v79so25587412qge.0 for <tls@ietf.org>; Thu, 17 Sep 2015 15:39:06 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:subject:date:user-agent:cc:references:in-reply-to :mime-version:content-type:content-transfer-encoding:message-id; bh=J7GYUYTEi3TlrBC9sXy8iOCEv2yT5FkIvilRAuE30UQ=; b=Q1/2o7nZXYoOw6hZHO3zB3M+5hcka/ie829F8taT5u1325yjYeLAp+KiAw1lYzFzQa pJZEivSMHwofgffLZ6MJRXivwSmuqMV1sABYkmN8FErYyjzRTF1rVRvawn7NC+UWba7H fNLTXVJ+iibIjApZnTpZbRT5OpZxx9Ors0FN08kWnpT+1iU0tZN8Ooywc2CEbv4IRD2s E4cR+BroI26cDwwNsL1daQkRWIL9AmEvlp4+LMWC+vFrm4kem1DVmRUpchngk+Q3nBtA 3tnZvMzl6YVZvTea4onX3t9lDPTwdWWZZIxe174NbRAOpaGVg2sSFBd1JQZzWzq+j+4Z mUHA==
X-Received: by 10.140.235.142 with SMTP id g136mr3266078qhc.18.1442529546463; Thu, 17 Sep 2015 15:39:06 -0700 (PDT)
Received: from dave-laptop.localnet (pool-72-94-152-197.phlapa.fios.verizon.net. [72.94.152.197]) by smtp.gmail.com with ESMTPSA id g49sm2257110qgg.10.2015.09.17.15.39.05 (version=TLSv1 cipher=RC4-SHA bits=128/128); Thu, 17 Sep 2015 15:39:06 -0700 (PDT)
From: Dave Garrett <davemgarrett@gmail.com>
To: tls@ietf.org
Date: Thu, 17 Sep 2015 18:39:04 -0400
User-Agent: KMail/1.13.5 (Linux/2.6.32-74-generic-pae; KDE/4.4.5; i686; ; )
References: <CABcZeBPnO4zn_HkvwLpLC+EVYN8EKOBEsR80oRt3HZgsiNGDoQ@mail.gmail.com> <CABkgnnVjQ3yqvJeuCAfL0Fx6BR0xAWhf1eKmVWXWY2nkRwfLGg@mail.gmail.com> <CAFewVt5CtVkgoA6Ls8_yd2f5b3TOONStGXHyCs8jxHap1qWPKg@mail.gmail.com>
In-Reply-To: <CAFewVt5CtVkgoA6Ls8_yd2f5b3TOONStGXHyCs8jxHap1qWPKg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: Text/Plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Message-Id: <201509171839.05044.davemgarrett@gmail.com>
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/Joyai-rUbS_SfXYUNZPBGy-CVR8>
Subject: Re: [TLS] Should we require implementations to send alerts?
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Sep 2015 22:39:08 -0000

On Thursday, September 17, 2015 06:30:12 pm Brian Smith wrote:
> Actually, Firefox has already stopped doing version fallback completely for
> all versions of TLS it supports, unless the website is on a whitelist.
> That's not really "gradually."

It wasn't switched from fully on to fully off, therefore, this is gradual. The whitelist is not small.

> A conformant TLS 1.3 implementation cannot be version intolerant. If it
> were version intolerant then it would not be a conformant TLS 1.3
> implementation. So, conformance requirements for TLS .1.3 servers don't
> matter as far as version intolerance is concerned.

TLS 1.3 implementations will have to deal with TLS 1.0 servers until the end of time, or TLS, whichever comes first. Lots of these are buggy as hell.


Dave

v2.23.0 | Report a Bug | By Email