Re: [TLS] AES and SSLv3 (was Re: Unfortunate current practices for HTTP

[Tim Dierks <[e-mail]>]

On Wed, Jan 19, 2011 at 2:07 PM, Martin Rex <[e-mail]> wrote:

> Tim Dierks wrote:
> >
> > He asserted SSL3/AES was not valid, but he didn't explain his rationale.
> >
> > Given that there is no standards-body ownership of SSL3, the correctness
> of
> > AES ciphersuites is a moot point. However, Postel's robustness principle
> > would tend to indicate that when a server selects such a ciphersuite, it
> > would be best for a client to play along, correct or not. I can't
> > immediately see any security reason why you'd be willing to negotiate
> SSL3,
> > but turn up your nose at an insufficiently blessed AES ciphersuite.
>
> I assume you're the one listed as "Tim Dirks, Consensus Development"  :)
>
>  as (co)author on the right top here:
>        http://tools.ietf.org/html/rfc2246
>  and potentially involved in the cipher suite interim registration here:
>        http://tools.ietf.org/html/draft-ietf-tls-protocol-02#page-51


"Dierks", but yes, that's no coincidence.


> The definition of cipher suites in the design of SSL and TLS is
> mostly orthogonal to the protocol version, and the change control
> was over the cipher suite registry was undoubtedly transferred
> to the TLS.  If cipher suites had ever been conceived to be
> protocol-version-specific, they would have partitioned the
> cipher suite code points.
>
> Quite obviously, the cipher suite registry was _NOT_ partitioned
> for TLSv1.0.  cipher suites were issued with no distinction whatsoever,
> so they were clearly meant to apply in a protocol-version-independent
> fashion, forwards and backwards.
>

I think I'm in a position of authority to say that we didn't seriously
consider the issue and there was no intention one way or the other about
whether newly-defined ciphersuites were valid in SSLv3 or not. Overlaps
needed to be excluded to avoid negotiation issues, but other than that, the
issue wasn't considered. That's why I say that arguments about what is
"correct" or not are really moot, because there's no actual standard that
specifies one way or the other.

 - Tim