IETF Logo Mail Archive

Re: [TLS] security levels for TLS

Nicolas Williams <Nicolas.Williams@sun.com> Fri, 12 October 2007 20:15 UTC

Return-path: <tls-bounces@lists.ietf.org>
Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IgQvO-0007aq-21; Fri, 12 Oct 2007 16:15:58 -0400
Received: from tls by megatron.ietf.org with local (Exim 4.43) id 1IgQvM-0007Xo-Mf for tls-confirm+ok@megatron.ietf.org; Fri, 12 Oct 2007 16:15:56 -0400
Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IgQvM-0007Xc-CO for tls@lists.ietf.org; Fri, 12 Oct 2007 16:15:56 -0400
Received: from sca-ea-mail-2.sun.com ([192.18.43.25]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IgQvH-00035i-2P for tls@lists.ietf.org; Fri, 12 Oct 2007 16:15:56 -0400
Received: from centralmail2brm.Central.Sun.COM ([129.147.62.14]) by sca-ea-mail-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id l9CKFeSD011568 for <tls@lists.ietf.org>; Fri, 12 Oct 2007 20:15:40 GMT
Received: from binky.Central.Sun.COM (binky.Central.Sun.COM [129.153.128.104]) by centralmail2brm.Central.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL, v2.2) with ESMTP id l9CKFdXx000173 for <tls@lists.ietf.org>; Fri, 12 Oct 2007 14:15:40 -0600 (MDT)
Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id l9CKFd26028265; Fri, 12 Oct 2007 15:15:39 -0500 (CDT)
Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id l9CKFadj028264; Fri, 12 Oct 2007 15:15:36 -0500 (CDT)
X-Authentication-Warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f
Date: Fri, 12 Oct 2007 15:15:35 -0500
From: Nicolas Williams <Nicolas.Williams@sun.com>
To: Mike <mike-list@pobox.com>
Subject: Re: [TLS] security levels for TLS
Message-ID: <20071012201535.GG24532@Sun.COM>
References: <c331d99a0710080621g7c0ec91et35c46553c23f4402@mail.gmail.com> <p0624082fc331b0ed0ecc@[192.168.1.100]> <FA998122A677CF4390C1E291BFCF59890849871E@EXCH.missi.ncsc.mil> <470D0243.3050009@pobox.com> <20071010180324.7ABC533C21@delta.rtfm.com> <470E4399.3010008@pobox.com> <20071011155829.965C733C28@delta.rtfm.com> <20071011162153.GO24532@Sun.COM> <470EF8DC.8060700@pobox.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <470EF8DC.8060700@pobox.com>
User-Agent: Mutt/1.5.7i
X-Spam-Score: -1.0 (-)
X-Scan-Signature: de4f315c9369b71d7dd5909b42224370
Cc: tls@lists.ietf.org
X-BeenThere: tls@lists.ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.lists.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@lists.ietf.org?subject=unsubscribe>
List-Archive: <http://www1.ietf.org/pipermail/tls>
List-Post: <mailto:tls@lists.ietf.org>
List-Help: <mailto:tls-request@lists.ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@lists.ietf.org?subject=subscribe>
Errors-To: tls-bounces@lists.ietf.org

On Thu, Oct 11, 2007 at 09:32:28PM -0700, Mike wrote:
> >The easy answer is to give the application fewer choices, namely a
> >choice of locally-configured profiles (see above).
> >
> >In fact, I strongly urge TLS API developers to provide such a facility.
> 
> I'm confused -- that is exactly what TLS::SetSecurityLevel (3);
> was intended to represent.  Perhaps if I had not used the number
> 3, but instead used SECURITY_LEVEL_STRONG this would have made
> more sense to people?

It's not what was requested early on in this thread.  Local, named
profiles -> good.  Standard profiles with absolute security ratings
associated with them -> super bad.

Nico
-- 


_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls

v2.23.0 | Report a Bug | By Email