Re: [TLS] NULL cipher to become a MUST NOT in UTA BCP

Bill Frantz <frantz@pwpconsult.com> Fri, 05 September 2014 04:06 UTC

Date: Thu, 04 Sep 2014 21:06:29 -0700
From: Bill Frantz <frantz@pwpconsult.com>
To: Nico Williams <nico@cryptonector.com>, tls@ietf.org
In-Reply-To: <CAK3OfOhvTS=wnH5yGnuFk0w_RH+op+Hg5iEKW2DrxuAu-Hoeqw@mail.gmail.com>
Message-ID: <r422Ps-1075i-64A8CB473A3A4501BBB2C3138C71A13E@Williams-MacBook-Pro.local>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: quoted-printable
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/kT5ye__ZrfdfcYCsyeFlvoKn8Cs
Subject: Re: [TLS] NULL cipher to become a MUST NOT in UTA BCP
Precedence: list

On 9/3/14 at 1:24 PM, nico@cryptonector.com (Nico Williams) wrote:

>This needs to apply to implementors.  It's hard to tell sysadmins to
>not do certain things.  You need to tell implementors what to allow
>for local policy.

I really like Victor's suggestion that implementations MUST NOT 
present both encryption and NULL cypher suites on a connection. 
They could either refuse to start up when configured with both, 
or they could silently remove the NULL cypher suites.

Cheers - Bill

---------------------------------------------------------------------------
Bill Frantz        |"We used to quip that "password" is the most common
408-356-8506       | password. Now it's 'password1.' Who said 
users haven't
www.pwpconsult.com | learned anything about security?" -- Bruce Schneier

[TLS] NULL cipher to become a MUST NOT in UTA BCP Ralph Holz
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Blumenthal, Uri - 0558 - MITLL
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Viktor Dukhovni
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Paul Hoffman
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Salz, Rich
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Viktor Dukhovni
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Blumenthal, Uri - 0558 - MITLL
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Ralph Holz
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Ralph Holz
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Viktor Dukhovni
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Viktor Dukhovni
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Paul Lambert
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Bodo Moeller
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Blumenthal, Uri - 0558 - MITLL
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Nico Williams
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Nikos Mavrogiannopoulos
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Yutaka OIWA
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Blumenthal, Uri - 0558 - MITLL
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Ralph Holz
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Viktor Dukhovni
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Ralph Holz
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Blumenthal, Uri - 0668 - MITLL
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Viktor Dukhovni
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Geoffrey Keating
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Blumenthal, Uri - 0668 - MITLL
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Ralph Holz
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Ralph Holz
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Nico Williams
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Ralph Holz
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Nico Williams
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Ralph Holz
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Nico Williams
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Ralph Holz
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Blumenthal, Uri - 0668 - MITLL
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Ralph Holz
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Blumenthal, Uri - 0558 - MITLL
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Yutaka OIWA
[TLS] uta-tls-bcp-02 thoughts (was: NULL cipher t… Viktor Dukhovni
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Bodo Moeller
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Yutaka OIWA
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Nico Williams
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Blumenthal, Uri - 0558 - MITLL
Re: [TLS] uta-tls-bcp-02 thoughts (was: NULL ciph… Blumenthal, Uri - 0558 - MITLL
Re: [TLS] uta-tls-bcp-02 thoughts (was: NULL ciph… Nico Williams
Re: [TLS] uta-tls-bcp-02 thoughts (was: NULL ciph… Blumenthal, Uri - 0558 - MITLL
Re: [TLS] uta-tls-bcp-02 thoughts Ralph Holz
Re: [TLS] uta-tls-bcp-02 thoughts Blumenthal, Uri - 0558 - MITLL
Re: [TLS] uta-tls-bcp-02 thoughts Ralph Holz
Re: [TLS] uta-tls-bcp-02 thoughts (was: NULL ciph… Barry Leiba
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Bill Frantz
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Daniel Kahn Gillmor
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Bodo Moeller
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Ralph Holz
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Manuel Pégourié-Gonnard
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Viktor Dukhovni
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Manuel Pégourié-Gonnard
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Ralph Holz
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Ilari Liusvaara
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Nico Williams
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Blumenthal, Uri - 0668 - MITLL
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Ralph Holz
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Bodo Moeller
Re: [TLS] NULL cipher to become a MUST NOT in UTA… Viktor Dukhovni