Re: [TLS] Comments on TLS identity protection

Peter Williams <home_pw@msn.com> writes:

>  
>> > There's no way in TLS to currently have a NULL MAC algorithm.> > I doubt there is lilkely to be one soon.
>  
> if we look at the text of SSLv3, it discussed null mac functions in the architecture:-
>  
> If the CipherSuite is SSL_NULL_WITH_NULL_NULL, encryption consists of the identity 
> operation (i.e., the data is not encrypted and the MAC size is zero implying that 
> no MAC is used). SSLCiphertext.length is SSLCompressed.length plus 
> CipherSpec.hash_size. 

Yes, but TLS explicitly forbids you to negotiate this algorithm
(i.e., it's only useful for performing the handshake).

   TLS_NULL_WITH_NULL_NULL is specified and is the initial state of a
   TLS connection during the first handshake on that channel, but must
   not be negotiated, as it provides no more protection than an
   unsecured connection.

So, it's basically a different way of expressing "do your first
handshake in the clear".

-Ekr

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls