Re: [TLS] RFC 5878 - why?

Trevor Perrin <trevp@trevp.net> Wed, 18 September 2013 18:37 UTC

Return-Path: <trevp@trevp.net>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 770CE11E8119 for <tls@ietfa.amsl.com>; Wed, 18 Sep 2013 11:37:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.977
X-Spam-Level:
X-Spam-Status: No, score=-2.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WXrDej4iFovu for <tls@ietfa.amsl.com>; Wed, 18 Sep 2013 11:37:01 -0700 (PDT)
Received: from mail-we0-f172.google.com (mail-we0-f172.google.com [74.125.82.172]) by ietfa.amsl.com (Postfix) with ESMTP id 7C7C711E8108 for <tls@ietf.org>; Wed, 18 Sep 2013 11:37:01 -0700 (PDT)
Received: by mail-we0-f172.google.com with SMTP id w61so6992776wes.31 for <tls@ietf.org>; Wed, 18 Sep 2013 11:37:00 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=at1HhawljOPOKyZTtm053+oKzew6s+NuDEcenqb0hwQ=; b=TFi1tI6EFPSdXjwLffC9II7h8TpWMONt/SQmNW8tow+jl0qBdfDTnLZt0Oj7txINnn NxzkUnIFL2POjZp5YgdWIC5plotVZqwI1TrBzUM0PAClBxEmDWJuCpNT4mhclU3OAnG1 P7HO+As5DVfxhDe+14vjn0stLUFNNTeYQ5jLUWOqM/H3PmOfqjVkMZ8J7BVt1P6ocU6U z7nZij6E/DJoXVDdkiclXPYs9goblqtak+C9SAsVv7vTNiiaX9Q27g29MbjXaLkLVp96 mwN721omLoOjasrZ5n80ChiVN6QTEl4cJiq0vmnCV1iAe+NpsbpEpvXjOyTgiYRrFdab ZwKQ==
X-Gm-Message-State: ALoCoQlmAQze57yVZvuqRs0I4wNIOMYMWsRIDNnxsSuvS4iJR1P9Jb/c/v7eNzLf6wOA0qKTiL+9
MIME-Version: 1.0
X-Received: by 10.180.160.165 with SMTP id xl5mr8251816wib.48.1379529420526; Wed, 18 Sep 2013 11:37:00 -0700 (PDT)
Received: by 10.216.61.13 with HTTP; Wed, 18 Sep 2013 11:37:00 -0700 (PDT)
X-Originating-IP: [76.14.67.86]
In-Reply-To: <20130918175118.A853A1A97F@ld9781.wdf.sap.corp>
References: <CAGZ8ZG0840WJ9fn9uiAiGKABGC6VkaqvRopFfaE2eWd8wE4RDQ@mail.gmail.com> <20130918175118.A853A1A97F@ld9781.wdf.sap.corp>
Date: Wed, 18 Sep 2013 11:37:00 -0700
Message-ID: <CAGZ8ZG3H-CywWVUo2Y_NrTNwSyxbA=H_V1oZaJ=pHjjoie5ecg@mail.gmail.com>
From: Trevor Perrin <trevp@trevp.net>
To: mrex@sap.com
Content-Type: text/plain; charset=ISO-8859-1
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] RFC 5878 - why?
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 18 Sep 2013 18:37:06 -0000

On Wed, Sep 18, 2013 at 10:51 AM, Martin Rex <mrex@sap.com> wrote:
> Trevor Perrin wrote:
>>
>
> If a document is published by the IETF, "Experimental" is the biggest
> warning sign that we have to caution consumers, except for refusing
> to publish.

The "Experimental" marking wasn't enough to prevent people like CT,
TACK, DTCP, and OpenSSL wasting a lot of time evaluating this and
trying to use it in the last couple of years.

A bunch of code was submitted into OpenSSL for this, then had to be
ripped out, CT specs were written for it, then rewritten,  and DTCP is
still grappling with this (see Darshak's email in this thread).

If 5878 is truly redundant with RFC 5246 and 4680 then I think this
group should consider marking it "obsoleted" to steer people away from
these mistakes.


> housley-tls-authz-extns specifically had an IPR issue, which by itself
> caused active _disinterest_ in the document, I assume:
>
>   http://www.ietf.org/mail-archive/web/tls/current/msg01523.html

Sure, I assume that's why no-one reviewed it carefully.


> Btw. there was an announcement of an implementation of both
> rfc4680 and housley-tls-authz-extns in GnuTLS in 2007:
>   http://www.ietf.org/mail-archive/web/tls/current/msg01518.html

GnuTLS support of authz-extns was removed several months later, and
the implementor opposed publication as an RFC:

http://www.ietf.org/mail-archive/web/ietf/current/msg48545.html


> If the stuff described in rfc5878 would have been proposed after
> rfc4680 existed, it probably would have used it.

5878 *DOES* use 4680, that's why it's so pointless.  It's a (bad)
extension mechanism nested inside of better ones.


> If you want to create an alternative to rfc5878 that makes proper use
> of rfc4680 -- go ahead.  But such an alternative might subject to the same
> IPR claims as rfc5878, so it might be the same hard sell as tls-authz-extns.

There's no need for an alternative.

TLS already has well-designed, standards-track extension mechanisms,
in the form of Hello Extensions and 4680 SupplementalData.


Trevor