Re: [TLS] Verifying X.509 Certificate Chains out of order

["Ben Laurie" <benl at google.com>]

On Mon, Oct 6, 2008 at 4:33 PM, Steven M. Bellovin <smb at cs.columbia.edu> wrote:
> On Mon, 06 Oct 2008 07:41:52 -0700
> Eric Rescorla <ekr at networkresonance.com> wrote:
>
>> I think there are two separate issues here:
>>
>> (1) Whether implementations should be required to send certificates
>>     in a specific order.
>> (2) Whether implementations should generate an error if they are
>>     received in another order.
>>
> "Be conservative in what you send; be liberal in what you accept."

I thought we'd given up on that as a useful generalisation since it
introduces security problems in some circumstances, for example HTTP
header stuffing. Which is not to say I am opposed to this particular
change, but that adage is an entirely insufficient justification.
_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls