IETF Logo Mail Archive

Re: [TLS] Should we require implementations to send alerts?

Dave Garrett <davemgarrett@gmail.com> Thu, 17 September 2015 23:15 UTC

Return-Path: <davemgarrett@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82CB81A8702 for <tls@ietfa.amsl.com>; Thu, 17 Sep 2015 16:15:40 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yWpVI5F1Lmsk for <tls@ietfa.amsl.com>; Thu, 17 Sep 2015 16:15:39 -0700 (PDT)
Received: from mail-qg0-x230.google.com (mail-qg0-x230.google.com [IPv6:2607:f8b0:400d:c04::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3DB551A8700 for <tls@ietf.org>; Thu, 17 Sep 2015 16:15:39 -0700 (PDT)
Received: by qgev79 with SMTP id v79so26136279qge.0 for <tls@ietf.org>; Thu, 17 Sep 2015 16:15:38 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:subject:date:user-agent:cc:references:in-reply-to :mime-version:content-type:content-transfer-encoding:message-id; bh=KmbxKnlS4rHeEptWvHirRm3nT11seOf8nRLOCwXqmvU=; b=cl278DKZoRdzFEHHaf2wBfsBooF6s9P1ZAH8treSlgY7mHmQhcaycBtpOgVKslFKJO 3kfWjLtfcWaUrNWEBRKxhzoXuqEjtgBho74JIf4GbIvtlGOSAd+VQ3pRw6EjOKIGH/Ht zEJhAoD79EAvSe8loK/0/do+MoKDpN4GonDpsJjba8jUFDYYgx64TbvPDXJrm2kCFF6V 8R6xDdit9NEBTtScPf0qGKP0yYh9DaM8cLIRH7yV7RLO85bcD/SnkTSbK4PiDqSyN36y RGPzUnuf+NPT1oFO3Pa1jc87zbeIQeaCs9X8T3eMsbHfJU1hpqjzncB8eR9Ccn0Kh/zI ygkA==
X-Received: by 10.140.235.142 with SMTP id g136mr3453217qhc.18.1442531738458; Thu, 17 Sep 2015 16:15:38 -0700 (PDT)
Received: from dave-laptop.localnet (pool-72-94-152-197.phlapa.fios.verizon.net. [72.94.152.197]) by smtp.gmail.com with ESMTPSA id a88sm2309579qge.18.2015.09.17.16.15.37 (version=TLSv1 cipher=RC4-SHA bits=128/128); Thu, 17 Sep 2015 16:15:38 -0700 (PDT)
From: Dave Garrett <davemgarrett@gmail.com>
To: tls@ietf.org, mrex@sap.com
Date: Thu, 17 Sep 2015 19:15:36 -0400
User-Agent: KMail/1.13.5 (Linux/2.6.32-74-generic-pae; KDE/4.4.5; i686; ; )
References: <20150917225819.725411A293@ld9781.wdf.sap.corp>
In-Reply-To: <20150917225819.725411A293@ld9781.wdf.sap.corp>
MIME-Version: 1.0
Content-Type: Text/Plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <201509171915.36923.davemgarrett@gmail.com>
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/vK-L0zEN7KN4L346f7DlDTvWd_g>
Subject: Re: [TLS] Should we require implementations to send alerts?
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Sep 2015 23:15:40 -0000

On Thursday, September 17, 2015 06:58:19 pm Martin Rex wrote:
> If one of the communication peers closes the network connection
> prior to completion of the TLS handshake, then the result is a 100%
> interoperability failure.  How is a "MUST send alert" supposed to
> affect that outcome when the server does not send one?
> Is it a 120% interop failure then?

Well, yeah, sort of. :p

If it's going to fail, I want it to fail in a way we can get it fixed. If I get a server in one of the giant tracking meta-bugs for servers that have TLS failures and I can see what is wrong, we can point to something to get fixed. If not, then we have nothing to go on and it probably won't be fixed ever.


Dave

v2.23.0 | Report a Bug | By Email