Re: [TLS] Issue 15: Mandate protection against CBC mode timing attack

["Ben Laurie" <benl at google.com>]

On 6/3/07, Eric Rescorla <ekr at networkresonance.com> wrote:
> http://www3.tools.ietf.org/wg/tls/trac/ticket/15
>
> NIST's comments suggest that the defense suggested in 6.2.3.2
> should be  mandatory. My argument is that hardware systems may
> operate in fixed time or otherwise be safe and so we shouldn't
> mandate any particular defense.

Perhaps we should mandate it for implementations that are vulnerable?

> Proposed resolution: leave as-is.
>
>
> _______________________________________________
> TLS mailing list
> TLS at lists.ietf.org
> https://www1.ietf.org/mailman/listinfo/tls

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls