Subject: [saag] Comments on draft-turner-ssl-must-not-01

From: Yaron Sheffer <[email-masked]>
Date: Sat, 26 Jun 2010 00:12:30 +0300

Hi,

in general, I support this approach. It's a good idea to advise the 
industry to retire old security protocols. But looking at this draft 
somewhat cynically as a PR piece, we could do a better job to get the 
message across.

- The draft does not mention a venue where it should be discussed. I 
just guessed at SAAG.

- The draft should talk a bit about deployment considerations, not just 
security. During the RI episode, there were numbers mentioned 
(published?) about the prevalence of different protocol versions. This 
is certainly relevant to the current discussion, and readers would 
benefit from having these statistics included.

- Speaking about which, I'm surprised the draft does not mention that 
support of RFC 5746 (RI) is mandatory. After all this one has a 
practical exploit, which I'm not sure is the case for other security 
issues mentioned here.

- The reference to the original Netscape spec is kind of useless. Please 
also mention that it was published as an I-D, still available at 
http://tools.ietf.org/html/draft-ietf-tls-ssl-version3-00. 
<http://tools.ietf.org/html/draft-ietf-tls-ssl-version3-00>

- The document provides some motivation on why TLS 1.1 is a SHOULD. 
However it RECOMMENDS TLS 1.2 (which today is very rarely implemented, 
AFAIK) and does not provide any motivation for that. I would say the 
document as written only supports a statement like "use of TLS 1.1 or 
higher is RECOMMENDED."

Thanks,

     Yaron

---

From: Sean Turner <[email-masked]>
Date: Tue, 29 Jun 2010 13:22:24 -0400

> somewhat cynically as a PR piece, we could do a better job to get the 

I meant to send this around to tls & saag, but got swamped doing IESG 
things.  I'll get back to you on these.

spt

> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag
>