Re: [TLS] Analysis of Interop scenarios TLS extension RI w/MCSV

["tom.petch" <[e-mail]>]

----- Original Message -----
From: "Nelson B Bolyard" <[e-mail]>
Sent: Friday, December 11, 2009 3:39 AM

> On 2009-12-10 14:01 PST, Marsh Ray wrote:
> > Martin Rex wrote:
> > Seems like SSLv3 was simultaneously one of the most critical protocols
> > for net security and orphaned.
>
> Stop right there.  Don't be led down the garden path.
>
> Look at the parent page.  Look at
> http://web.archive.org/web/20050205162914/wp.netscape.com/eng/ssl3/
>
> It clearly says that "The most recent Draft SSL 3.0 specification, an
> Internet Draft dated November 1996, may be viewed here. It is an ASCII
> document".  It is a link to http://wp.netscape.com/eng/ssl3/draft302.txt
> which is draft-freier-ssl-version3-02.txt, now seen at
> http://www.mozilla.org/projects/security/pki/nss/ssl/draft302.txt

Weirder and weirder.  Yes, you are right (of course) and I now have a copy of
-02.

But....  When I go to tools.ietf and ask for draft-freier, it produces -01; if I
ask explicitly for -02, it produces -01.

Go to Watersprings (which I always do before using tools.ietf) and it tells me
of -00 and -01 and that the last was superseded by draft-tls-...

So both the ietf archive and the Watersprings archive deny knowledge of -02,
which, in any other circumstance, I would take as proof beyond reasonable
doubt that there never was a -02.

Ah well, they never said the security was easy.

Tom Petch

> That parent page also says:  "The previous draft of the SSL 3.0
> Specification, dated March 1996, may be viewed in this HTML document."
> which is a link to
>
http://web.archive.org/web/20050206124632/wp.netscape.com/eng/ssl3/ssl-toc.html
> which in turn has a link to the page Martin cited above.
>
> You'll find my name in some of those pages, too.  Don't let a non-Netscape
> person tell you what was, and what was not "official" at Netscape.
>
> Netscape never orphaned 3.0.  It kept the "most recent draft" alive for
> the rest of its days, and is still kept alive today at Mozilla.org, which
> runs NSS code which is a direct descendant of Netscape's original code.