Re: [TLS] Verifying X.509 Certificate Chains out of order

Ben and all,

  I fullu agree with you Ben.  I for one am often willing to send
what I feel is appropriate wheather or not others believe so
or not, as long as it is in context and in keeping with the
theme or topic at hand.

Ben Laurie wrote:

> On Mon, Oct 6, 2008 at 4:33 PM, Steven M. Bellovin <smb@cs.columbia.edu> wrote:
> > On Mon, 06 Oct 2008 07:41:52 -0700
> > Eric Rescorla <ekr@networkresonance.com> wrote:
> >
> >> I think there are two separate issues here:
> >>
> >> (1) Whether implementations should be required to send certificates
> >>     in a specific order.
> >> (2) Whether implementations should generate an error if they are
> >>     received in another order.
> >>
> > "Be conservative in what you send; be liberal in what you accept."
>
> I thought we'd given up on that as a useful generalisation since it
> introduces security problems in some circumstances, for example HTTP
> header stuffing. Which is not to say I am opposed to this particular
> change, but that adage is an entirely insufficient justification.
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

Regards,

Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!)
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is
very often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B;
liability depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS.
div. of Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail
jwkckid1@ix.netcom.com
My Phone: 214-244-4827

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls