Re: [TLS] draft-ietf-tls-renegotation: next

[Martin Rex <[e-mail]>]

Marsh Ray wrote:
> 
> > The only reason why secure TLS renegotiation can be considered
> > an update to the existing installed base at all (and not a different
> > non-interoperable protocol), is that renegotiation has never been
> > a core element of SSLv3/TLS and is optional-to-implement.

There seems to be an illusion that this secure TLS renegotiation
update can be forced upon vendors or implementors.

No, it can not.

There is an incentive called "competitive advantage", but it does
not apply to commodity items in the consumer market that are 2+ years old.

If you can force anything from those vendors, then it is a switch
to disable old renegotiation, in case that is (unintentially) available.
That's it.


If you really want to do the community a favor, then this update
should be so "small&easy" for those vendors that they can actually
put it into installed base, even when that is 2+ years old.

If the IETF's "solution" is that you can only implement the
whole schmear or nothing, then this is not going to happen to
the installed base -- and it is not the fault of those vendors,
they can point to the IETF, because of a new spec that may cause
their customers interop problems in the future.


Some vendors will appreciate this as a "business opportunity",
but I think this is a big waste of money.


-Martin