Re: [TLS] Encrypt-then-MAC again (was Re: padding bug)

[Peter Gutmann <[e-mail]>]

Martin Rex <[e-mail]> writes:

>TLSv1.2 is a royal PITA for TLS clients, because it requires a reconnect
>fallback facility to be implemented by ***EVERY*** application caller client 
>on top of TLS, ***PLUS*** every application caller will have to memorize the 
>fallback for every destination or the latency will be a royal pain for every 
>new handshake after the TLS session expires from the client-side TLS session 
>cache (when client-side session caching is used at all.  

It's a PITA in general because it introduces a bunch of unexplained and more
or less arbitrary restrictions and silly-walk requirements (e.g. if you do
X with algorithm Y then you also need to do Z) which have no effect except to 
break interoperability.  Things mostly work at the moment because by mutual
unspoken consensus implementers ignore some of the sillier requirements, or
because there's a common mode like using SHA-256 everywhere that seems to 
work OK for all implementations.  At some point in the future though this is 
going to cause headaches when other implementations that don't know how to
interpret the spec in order to make things work come along.

Peter.