RE: [TLS] Record layer corner cases

[pgut001 at cs.auckland.ac.nz (Peter Gutmann)]

"Kemp, David P." <DPKemp at missi.ncsc.mil> writes:

>RFC 3280 (and draft 3280bis-05) clearly specify that trust anchors are
>maintained out of band, and that trust anchor information does not include a
>validity period any other certificate fields except the four listed:

At the time this first appeared (in X.509v4 drafts) I did an informal survey
of PKI implementors, and exactly *zero* implementors were aware of this sudden
change retroactively hacked onto X.509's behaviour.  It may be in the spec
now, but how many existing implementations do you think will handle this as
required?  To handle this complete reversal of root cert handling you'd have
to more or less tear down everything built in the last 10-15 years and start
again.  I wonder what the chances of that happening are?

(The correct way to handle this change would have been to stipulate the pre-
 X.509v4 behaviour by default, and then require the presence of some special
 critical extension to denote the new behaviour.  As it stands, the text is
 little better than random noise for all the effect it'll have on
 implementors.  The horse not only bolted on this one 15 years ago, it's had
 time to raise entire herds of new horses who aren't going to go back in the
 barn no matter how hard you slam the door).

Peter.

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls