Re: [TLS] Should we require implementations to send alerts?

[Dave Garrett <[e-mail]>]

On Thursday, September 17, 2015 03:27:10 pm Brian Smith wrote:
> Hubert Kario <[e-mail]> wrote:
> > and yet Firefox depends on them to report human-readable errors to users
> > when it can't connect to a server...
> 
> In what situation will a conformant implementation send Firefox an alert?
> Firefox is conformant (AFAICT) and in particular Firefox implements the
> mandatory-to-implement cipher suite. Therefore no conformant implementation
> should be sending Firefox an alert other than close_notify.
> 
> (We should focus on conformant implementations because non-conformant
> implementations can do whatever they want, by definition).

The flaw in your logic here is the fact that specifications change. Firefox will receive a protocol_version alert from a version-incompatible server. Both implementations could be fully conformant to their target specifications, just different versions. Without this alert being consistently sent, everyone gave up and implemented a sloppy fallback mechanism which made downgrade attacks rather simple.

Likewise, you'll get an alert if different ciphers are supported on each endpoint. Mandatory to implement does not mean mandatory to use.

Certificate alerts can happen pretty much anywhere and this is a user-configurable area so it's not the implementations fault, but it needs to know what happened for anyone to be able to handle it.

We could probably build a whole list here, but that's enough for me to say that alerts matter in conformant implementations and that we need to always expect they're used correctly.


Dave