Re: [TLS] To extend or not to extend

Bodo Moeller <bmoeller@acm.org> Sun, 15 November 2009 22:43 UTC

From: Bodo Moeller <bmoeller@acm.org>
To: Nelson B Bolyard <nelson@bolyard.me>
In-Reply-To: <4B00823F.3030103@bolyard.me>
References: <AC1CFD94F59A264488DC2BEC3E890DE5091A760A@xmb-sjc-225.amer.cisco.com> <20091115113857.4E04D69F7B2@kilo.networkresonance.com> <4B006F37.6030905@bolyard.me> <F1240B36-28C3-44EC-9B42-9C099F83365D@acm.org> <4B00823F.3030103@bolyard.me>
Message-Id: <ED68D89B-AE53-4836-9831-2661A7926E50@acm.org>
Content-Type: text/plain; charset="US-ASCII"; format="flowed"; delsp="yes"
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v936)
Date: Sun, 15 Nov 2009 14:43:27 -0800
Cc: tls@ietf.org
Subject: Re: [TLS] To extend or not to extend
Precedence: list

On Nov 15, 2009, at 2:35 PM, Nelson B Bolyard wrote:

> The interesting case is the server that you have heard of before,  
> and do
> use, perhaps with some frequency, but you do not know if it is  
> vulnerable
> or not.  Since you are a regular user of that server, if it is  
> vulnerable
> then the next time you use it, you may be vulnerable, too.  As a  
> lenient
> client of that server, you have no protection from the attack.

Yes.  Using a lenient client means the responsibility to protect  
against the attack is with the server.

Bodo

[TLS] To extend or not to extend Joseph Salowey (jsalowey)
Re: [TLS] To extend or not to extend Eric Rescorla
Re: [TLS] To extend or not to extend Bodo Moeller
Re: [TLS] To extend or not to extend Martin Rex
Re: [TLS] To extend or not to extend Nicolas Williams
Re: [TLS] To extend or not to extend Nelson B Bolyard
Re: [TLS] To extend or not to extend Nelson B Bolyard
Re: [TLS] To extend or not to extend Bodo Moeller
Re: [TLS] To extend or not to extend Nelson B Bolyard
Re: [TLS] To extend or not to extend Bodo Moeller
Re: [TLS] To extend or not to extend Joseph Salowey (jsalowey)
Re: [TLS] To extend or not to extend Eric Rescorla