Re: [TLS] Deployment ... Re: This working group has failed

[Watson Ladd <[e-mail]>]

On Mon, Nov 18, 2013 at 8:41 AM, Salz, Rich <[e-mail]> wrote:
> These seem contradictory to me:
>
>>> TLS 1.2 solves the same problem as TLS 1.0. It should therefore have
the same API.
>> The current APIs have caused lots of security bugs as people don't use
them correctly. The solution: high level APIs that won't change ...
The point is to do it right for both TLS 1.2 and TLS 1.0. If you expose
details you shouldn't you are not going to be able to keep them stable
or used correctly.
>
> The IETF has traditionally avoided API's and doesn't get involved in
high-level language wars (other than ASN.1/DER vs ASCII art :)
I vote ASCII art: it keeps the specs simple by imposing a cost on
complexity. Now, someone try making ASCII art for all of TLS.

As for the API issue, I am not suggesting that we standardize it anymore
than the IPSEC people standardized F/SWAN. Rather I am suggesting that we
view the lamentable state of the OpenSSL and NSS source code as problems
that are keeping RC4 alive.

If the WG wants to ignore the need for reference implementations and
interoperability testing fine. But that is not the way successful standards
have emerged from the IETF.
>
> /r$
>
> --
> Principal Security Engineer
> Akamai Technology
> Cambridge, MA

-- 
"Those who would give up Essential Liberty to purchase a little Temporary
Safety deserve neither Liberty nor Safety."
-- Benjamin Franklin