Re: [TLS] Deprecating alert levels

On Wed, Oct 19, 2016 at 11:24 AM, Joseph Salowey <joe@salowey.net> wrote:

> It does not look like we have sufficient consensus to adopt this PR.
> While there is some support for simplifying alerts by removing the alert
> level, the current discussion raises some issues about the general
> approach.
>
> 1.  Is it appropriate for all unknown alerts to be treated as fatal? (the
> current draft already states this)
>

I thought we had pretty strong consensus on this. I'd be sad to take it
back.

2.  Are there cases, such as unrecognized name. where it is useful to
> indicate that an alert is not fatal?  If so how should this case be handled?
>

I think this alert was a mistake :)

-Ekr

>
> Cheers,
>
> J&S
>
> On Wed, Oct 19, 2016 at 8:58 AM, Martin Rex <mrex@sap.com> wrote:
>
>> Kyle Nekritz wrote:
>> >
>> >> This list is already missing the warning-level "unrecognized_name"
>> alert,
>> >> and such a change would imply that all new/unrecognized alerts are
>> going
>> >> to be treated as fatal forever (i.e. that no new warning-level alerts
>> >> can ever be defined).
>> >
>> > That alert is currently defined as a fatal alert (see section 6.2 in the
>> > current draft).  RFC 6066 also states "It is NOT RECOMMENDED to send a
>> > warning-level unrecognized_name(112) alert, because the client's
>> behavior
>> > in response to warning-level alerts is unpredictable.", which I think
>> > illustrates the problem. Allowing new non-fatal alerts to be added later
>> > would require that existing clients ignore unknown warning alerts,
>> > which I think is somewhat dangerous.
>>
>> It seems that rfc6066 is not clear enough in explaining the issue
>> about the situation with the two WELL-DEFINED (but poorly implemented)
>> variants of the TLS alerts
>>
>>   (1)  unrecognized_name(112)  level WARNING
>>   (2)  unrecognized_name(112)  level FATAL
>>
>> See the *ORIGINAL* specification which created *BOTH* of these alert
>> variants:
>>
>> https://tools.ietf.org/html/rfc3546#page-10
>>
>>
>>    If the server understood the client hello extension but does not
>>    recognize the server name, it SHOULD send an "unrecognized_name"
>>    alert (which MAY be fatal).
>>
>>
>> -Martin
>>
>> _______________________________________________
>> TLS mailing list
>> TLS@ietf.org
>> https://www.ietf.org/mailman/listinfo/tls
>>
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>
>