Re: [TLS] The TLS_FALLBACK_SCSV time bomb (was: Re: Working Group Last Call for draft-ietf-tls-downgrade-scsv-00)
Peter Gutmann <pgut001@cs.auckland.ac.nz> Sun, 19 October 2014 04:13 UTC
Return-Path: <pgut001@cs.auckland.ac.nz>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DFAF11A026C for <tls@ietfa.amsl.com>; Sat, 18 Oct 2014 21:13:47 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.21
X-Spam-Level:
X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W5c82Cga2cVE for <tls@ietfa.amsl.com>; Sat, 18 Oct 2014 21:13:46 -0700 (PDT)
Received: from mx2.auckland.ac.nz (mx2.auckland.ac.nz [130.216.125.245]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C67A1A014C for <tls@ietf.org>; Sat, 18 Oct 2014 21:13:46 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=uoa; t=1413692028; x=1445228028; h=from:to:subject:date:message-id: content-transfer-encoding:mime-version; bh=icN68bpoqDgHb+gmDWM0jvPyJlrDopkcP+WZ2E5k81Y=; b=Bqu6iyG49fETqcd67ohoEdWKZUuorlwHbAEzHu6eAJXSffyRR5h9cvne aI1b6D6ZszTrOQmRdK3dRgeW9u6wZco/ilE7icD88P2bzdaEpbfIa239Z ErZE7AVRYO24dYQRgJ5nu1ErOzv3MUdv/Za8UIECvyudeVV0B9EAfuGSp k=;
X-IronPort-AV: E=Sophos;i="5.04,630,1406548800"; d="scan'208";a="284093837"
X-Ironport-HAT: MAIL-SERVERS - $RELAYED
X-Ironport-Source: 130.216.4.112 - Outgoing - Outgoing
Received: from uxchange10-fe1.uoa.auckland.ac.nz ([130.216.4.112]) by mx2-int.auckland.ac.nz with ESMTP/TLS/AES128-SHA; 19 Oct 2014 17:13:46 +1300
Received: from UXCN10-5.UoA.auckland.ac.nz ([169.254.5.15]) by uxchange10-fe1.UoA.auckland.ac.nz ([130.216.4.112]) with mapi id 14.03.0174.001; Sun, 19 Oct 2014 17:13:44 +1300
From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: "<tls@ietf.org>" <tls@ietf.org>
Thread-Topic: [TLS] The TLS_FALLBACK_SCSV time bomb (was: Re: Working Group Last Call for draft-ietf-tls-downgrade-scsv-00)
Thread-Index: Ac/rUxJ+nD9tEJYuSL6aCRNDMCW07Q==
Date: Sun, 19 Oct 2014 04:13:44 +0000
Message-ID: <9A043F3CF02CD34C8E74AC1594475C739B9D2991@uxcn10-5.UoA.auckland.ac.nz>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [130.216.158.4]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/pP5R0rOsfa7ou3IF4mYGtYNNphA
Subject: Re: [TLS] The TLS_FALLBACK_SCSV time bomb (was: Re: Working Group Last Call for draft-ietf-tls-downgrade-scsv-00)
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 19 Oct 2014 04:13:48 -0000
Andrei Popov <Andrei.Popov@microsoft.com> writes: >I think about 60-90 days or so, for those clients and servers that get >regular updates. ... and 5,000 days for clients and servers where you have to wait for the hardware to die in order to see an update. (10,000 days is probably on the long side, but I still have to maintain backwards-compatible bugfixes for SSH versions from the late 1990s in major backbone routing gear, so we're talking a 15-year lifespan at least, which is where the 5K days came from). Oh, and given your affiliation, I was tempted to add: "So Microsoft are planning to roll out an update to Windows XP then?" :-). Peter.
- Re: [TLS] The TLS_FALLBACK_SCSV time bomb (was: R… Peter Gutmann
- Re: [TLS] The TLS_FALLBACK_SCSV time bomb (was: R… Andrei Popov
- Re: [TLS] The TLS_FALLBACK_SCSV time bomb (was: R… Peter Gutmann
- Re: [TLS] The TLS_FALLBACK_SCSV time bomb (was: R… Hubert Kario
- Re: [TLS] The TLS_FALLBACK_SCSV time bomb (was: R… Andrei Popov
- Re: [TLS] The TLS_FALLBACK_SCSV time bomb (was: R… Martin Rex
- Re: [TLS] The TLS_FALLBACK_SCSV time bomb (was: R… Yoav Nir