Re: [TLS] Comments on TLS identity protection

Peter Williams <home_pw@msn.com> writes:

> Eric:
>  
> I hope Im doing ok on CRLFs. I add them manually in my paragraphs, when I 
> remember. As far as I can determine , there is no way for a  hotmail.com users 
> to meet the IETF usability rules (wordwrap before 65chars, affixing CRLF each line),
> I'm happy to be shown how, tho, by  power user! I'm keeping msn, tho, as it
> gives me excellent IETF S/MIME from my EVDO PDA, via a webmail.

Prehistoric technology, dude! OK, I'll try to adjust.

>> > Peter Williams <home_pw@msn.com> writes:> > Id say the nth handshake can select to send "no server cert" whenever its > > cooperating to complete an anonymous-ciphersuite-targeted handshake.> > So, assume there are only two ciphers suite values in the HSM : RSA, RSA-ANON. > > There is no such thing as RSA anon in SSLv3 or TLS. 
> For a long time Ive regarded SSLv3 as http://wp.netscape.com/eng/ssl3/3-SPEC.HTM#8-1
> Its an old bookmark!

Here's the SSLv3 spec that I usually use as a reference.

http://wp.netscape.com/eng/ssl3/draft302.txt

You'll note that it's very similar to TLS :)

> it doesnt even contain a set of ciphersuite declarations. It clearly
> reinforces what I said tho: server cert presentation is ALWAYS optional
> architecturally, and ServerKeyExchange is then used, instead. Netcape
> documents were never particular formal! They were always in a rush.

I don't agree with this interpretation.

Here's the key text, from A.6.

   The following CipherSuite definitions require that the server
   provide an RSA certificate that can be used for key exchange.  The
   server may request either an RSA or a DSS signature-capable
   certificate in the certificate request message.

     CipherSuite SSL_RSA_WITH_NULL_MD5                  = { 0x00,0x01 };
     CipherSuite SSL_RSA_WITH_NULL_SHA                  = { 0x00,0x02 };
     CipherSuite SSL_RSA_EXPORT_WITH_RC4_40_MD5         = { 0x00,0x03 };
     CipherSuite SSL_RSA_WITH_RC4_128_MD5               = { 0x00,0x04 };
     CipherSuite SSL_RSA_WITH_RC4_128_SHA               = { 0x00,0x05 };
     CipherSuite SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5     = { 0x00,0x06 };
     CipherSuite SSL_RSA_WITH_IDEA_CBC_SHA              = { 0x00,0x07 };
     CipherSuite SSL_RSA_EXPORT_WITH_DES40_CBC_SHA      = { 0x00,0x08 };
     CipherSuite SSL_RSA_WITH_DES_CBC_SHA               = { 0x00,0x09 };
     CipherSuite SSL_RSA_WITH_3DES_EDE_CBC_SHA          = { 0x00,0x0A };

-Ekr

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls