IETF Logo Mail Archive

Re: [TLS] TLS 1.3 - Support for compression to be removed

takamichi saito <saito@cs.meiji.ac.jp> Sat, 03 October 2015 22:44 UTC

Return-Path: <tan1tan2tan3tan4@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E7141A883D for <tls@ietfa.amsl.com>; Sat, 3 Oct 2015 15:44:24 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.65
X-Spam-Level:
X-Spam-Status: No, score=-1.65 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cZXxiMkLgzWS for <tls@ietfa.amsl.com>; Sat, 3 Oct 2015 15:44:23 -0700 (PDT)
Received: from mail-pa0-x22a.google.com (mail-pa0-x22a.google.com [IPv6:2607:f8b0:400e:c03::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EC4BD1A883C for <tls@ietf.org>; Sat, 3 Oct 2015 15:44:22 -0700 (PDT)
Received: by pablk4 with SMTP id lk4so138152960pab.3 for <tls@ietf.org>; Sat, 03 Oct 2015 15:44:22 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:content-type:mime-version:subject:from:in-reply-to:date :content-transfer-encoding:message-id:references:to; bh=2mwYaEYLCixJd85BmR0meP6Ny9Se0uX6A4HRSTOhoYg=; b=RYl0VbsKqLo5yWxV1i19HmnVmJFrAgjWASOlBEKo51VEEVLjwJCtK8XRogPBYt+Njn NkAo35thiuuRpEQfgDtdnRMeAin79giD0RN0tgMyY0AZlm5xHMDjxKnGpo0DV42W2lHp LptG4OtYvSA5zC3IvSmUgS95xEUTMhBt1k06fp4S0XUns5X8leDfHGhEKtCuenJ55Igv PPDwtRQr7bdXZK5jIaGJjH4rVvS8vZjjcuUuhSCeiDSmDvXeCG0+yQ/eNBU2awuSnXMb 8llMUzFbHAXG5uC0Nks7OaT1W+lqOsFK80R5xN1ouI4HGG6uRM8OSh7NJ77sZj/Ao4vY xrjg==
X-Received: by 10.69.2.69 with SMTP id bm5mr29053325pbd.41.1443912262618; Sat, 03 Oct 2015 15:44:22 -0700 (PDT)
Received: from [192.168.11.7] (27-142-114-198.rev.home.ne.jp. [27.142.114.198]) by smtp.gmail.com with ESMTPSA id xz5sm19274410pbb.12.2015.10.03.15.44.21 for <tls@ietf.org> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sat, 03 Oct 2015 15:44:21 -0700 (PDT)
Sender: "saito@cs.meiji.ac.jp" <tan1tan2tan3tan4@gmail.com>
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Apple Message framework v1283)
From: takamichi saito <saito@cs.meiji.ac.jp>
In-Reply-To: <682cb934aeeb42fabdf1fecfccf4c5b5@ustx2ex-dag1mb3.msg.corp.akamai.com>
Date: Sun, 04 Oct 2015 07:44:21 +0900
Content-Transfer-Encoding: quoted-printable
Message-Id: <7E1B8B3D-DEF5-439A-8E56-0CB2DFC061A8@cs.meiji.ac.jp>
References: <79C632BCF9D17346A0D3285990FDB01AA3B9DAD8@HOBEX21.hob.de> <55FC5822.5070709@trigofacile.com> <77583acbe981488493fd4f0110365dae@ustx2ex-dag1mb1.msg.corp.akamai.com> <55FC7343.3090301@trigofacile.com> <6796F70E-44FD-4CD8-A691-6D0BFAE6EFDC@cs.meiji.ac.jp> <682cb934aeeb42fabdf1fecfccf4c5b5@ustx2ex-dag1mb3.msg.corp.akamai.com>
To: tls@ietf.org
X-Mailer: Apple Mail (2.1283)
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/vCKw-EEOUL_sTFnjlPwJkD_YTYE>
Subject: Re: [TLS] TLS 1.3 - Support for compression to be removed
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 03 Oct 2015 22:44:24 -0000

On 2015/10/03, at 0:24, Salz, Rich wrote:

> 
>> 1) We know CRIME threat, but it can not be risk for everyone.
>> e.g., CVSS v2 Base Score: 2.6 (LOW)
> 
> CVSS isn't always appropriate; CVSS2 called Heartbleed a 5; CVS v3 called it 7.5
> 

We know it, but one of indicators.
How can you say the dangerous or risk instead of it? 
My point is, CRIME is risk for every case? even when we have option  in tls1.3, in case that default is off. 


>> Which one is safer, "tls1.2" v.s. "tls1.3 with comp/decomp" ?
> 
> They are equivalent.  If you use AES-GCM and ECDHE, and you don't need 0RTT, then there is no compelling reason to use TLS 1.3.
> 


If so, some people can skip tls1.3.

;; takamixhi saito

v2.23.0 | Report a Bug | By Email