Re: [TLS] Heartbleed / protocol complexity

[Geoffrey Keating <[e-mail]>]

Hanno Böck <[e-mail]> writes:

> Hi,
> 
> It's kinda surprising that nobody yet started a thread on the biggest
> issue in TLS these days on the TLS WG list. So I make a start.
> 
> First thought might be "no protocol issue, software bug, not an issue
> for the TLS standardization process". But I think there is an issue at
> hand here: We have a severe bug in a rarely used TLS extension.
> 
> And: This is the second time in just a few days a TLS extension gives
> headache. We just had the Dual EC paper exposing possible security
> issues with the Extended Random extension (which luckily never came to
> life).

I can add a few more examples: compression and client-initiated
renegotiation are two things that were optional to implement, and
that some implementations didn't implement and were saved security
vulnerabilities by not doing so.

I seem to remember that there have also been bugs with NULL or
'export' cipher suites being unexpectedly enabled.

I think perhaps the lesson to learn from this is that implementations
should probably not aim to be 'complete' or 'full-featured' TLS
implementations, but rather only implement what is needed for their
target audience; and if they do implement features that only some users
will need, disable them by default.