Re: [TLS] The risk of misconfiguration

[Viktor Dukhovni <[e-mail]>]

On Sun, May 11, 2014 at 08:04:03PM -0700, Michael D'Errico wrote:

> Bill Frantz wrote:
> >
> >Now I recognize that there is a significant footgun in having NULL cypher
> >suites in a mix of protocols offered by a client. One way to reduce the
> >risk is to say, "The server MUST reject any connection attempt where the
> >offered cypher suites include both suites providing encryption and those
> >which have NULL encryption.
> 
> Why not have the server choose a non-NULL cipher suite if both types
> are offered instead of rejecting the connection?

I am not convined that any special action should be taken on the
server side.  My original suggestion was that client implementations
could by default attempt to catch some configuration errors (user
interface improvement).  Server-side enforcement (effectively a
protocol change) is likely unnecessary complexity.

There may even be use-cases in which the client prefers authenticated
NULL ciphers, but if the choice is between a handshake failure or
being forced to encrypt, is willing to encrypt.  I expect this to
be quite rare, but there is no compelling reason to rule this out.

Clients that offer NULL ciphers to servers not a-priori known to
support them will almost always find their offer declined.

So on balance I don't think it would be appropriate to *require*
any particular server behaviour here, however implementations MAY
implement optional features that enforce sensible policies at either
end.

-- 
	Viktor.