Re: [Uta] Proposed list of deliverables

[Leif Johansson <[e-mail]>]

On 2014-01-20 12:09, Linus Nordberg wrote:
> "Orit Levin (LCA)" <[e-mail]> wrote
> Sat, 18 Jan 2014 06:24:44 +0000:
>
> | Below is the list of deliverables for your consideration:
> | 
> | 1. A threat analysis document containing a collection of known
> | security breaches to application protocols due to poor use of TLS
> | (Likely an Informational RFC)
> | 2. Applications' independent document recommending best existing and
> | future practices for using TLS (Likely a BCP or a Proposed Standard
> | RFC)
> | 3. A set of documents, each describing best existing and future
> | practices for using TLS with a specific application protocol, i.e.,
> | SMTP, POP, IMAP, XMPP, HTTP 1.1, etc. (Case-by-case likely a BCP or a
> | Proposed Standard RFC)
> | 4. A document discussing (and potentially defining) how to apply the
> | opportunistic encryption approach (preliminary outlined in
> | draft-farrelll-mpls-opportunistic-encrypt-00.txt) to TLS. (Category
> | TBD)
>
> These all seem fine to me. I'd like to propose another document
> describing fingerprintability of TLS traffic and how TLS is being
> fingerprinted in practice.
>
Isn't that more a perpass thing? Unless you propose operational BCPs for
avoiding fingerprinting that is...