Re: [TLS] draft-rescorla-tls-renegotiate.txt

To: tls at ietf.org
Subject: Re: [TLS] draft-rescorla-tls-renegotiate.txt
From: Michael D'Errico <mike-list at pobox.com>
Date: Fri, 06 Nov 2009 14:17:53 -0800
Delivered-to: tls at core3.amsl.com
Dkim-signature: v=1; a=rsa-sha1; c=relaxed; d=pobox.com; h=message-id :date:from:mime-version:to:subject:references:in-reply-to :content-type:content-transfer-encoding; s=sasl; bh=LwjREnuTZ+AG +OXt00x9FDLMwgk=; b=MJZQNFYkIxrwLc/V+D7C//5Ma+0Dq2jA1iXp402sh0xR gPchZn7NvyMvqV3cxXNeEDmlRdrxL7TNn5RCyZLDlzzy7KdRuO7VwFikYy6nx8Xp RqqPgiMUi6XY73mtWzYXe12PwHNIgKkSBTcX+EwTGfTQHrMQs8jHKwC0mbah0Ns=
Domainkey-signature: a=rsa-sha1; c=nofws; d=pobox.com; h=message-id:date :from:mime-version:to:subject:references:in-reply-to :content-type:content-transfer-encoding; q=dns; s=sasl; b=LK9WJt dzSkFGsg8PtVyLut1dkNGgIB8spld3vNUtqAXtj4/+eEwrNoptUyrg4dEUa7BCWA gYjdZp13f5pyHFgNFgwOU7vtpP7e9FfwGmCrTXLOH36UC4DHU/u2OKyRcFj/YWrZ neetqCj0ObD1aF2Xd9tIOJAI4kkP2mCoff2KY=
In-reply-to: <4AF497C5.5060801 at REDHAT.COM>
List-archive: <http://www.ietf.org/mail-archive/web/tls>
List-help: <mailto:tls-request@ietf.org?subject=help>
List-id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-post: <mailto:tls@ietf.org>
List-subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
List-unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
References: <200911061959.nA6JxnnB001831 at fs4113.wdf.sap.corp> <4AF497C5.5060801 at REDHAT.COM>
User-agent: Thunderbird 2.0.0.23 (Macintosh/20090812)

Suggestions?

For us, this means SSL3 would be dead in the case you require the extension.


A server can still negotiate an SSLv3 connection as it does today.
It just can't re-negotiate that connection later.  This is true for
all TLS versions as well; you can still allow unpatched clients to
connect, just not renegotiate.  The servers impacted by this change
are those that require renegotiation to obtain client credentials.

Mike

Follow-Ups:
- Re: [TLS] draft-rescorla-tls-renegotiate.txt
  - From: Marsh Ray

References:
- Re: [TLS] draft-rescorla-tls-renegotiate.txt
  - From: Martin Rex
- Re: [TLS] draft-rescorla-tls-renegotiate.txt
  - From: Robert Relyea

Prev by Date: Re: [TLS] draft-rescorla-tls-renegotiate.txt
Next by Date: Re: [TLS] TLS or HTTP issue?
Previous by thread: Re: [TLS] draft-rescorla-tls-renegotiate.txt
Next by thread: Re: [TLS] draft-rescorla-tls-renegotiate.txt
Index(es):
- Date
- Thread

Re: [TLS] draft-rescorla-tls-renegotiate.txt

Note: Messages sent to this list are the opinions of the senders and do not imply endorsement by the IETF.