Re: [TLS] Accept draft-turner-ssl-must-not-02 as WG item

Sean Turner <turners@ieca.com> Wed, 06 October 2010 16:40 UTC

Message-ID: <4CACA6A6.3000906@ieca.com>
Date: Wed, 06 Oct 2010 12:41:10 -0400
From: Sean Turner <turners@ieca.com>
User-Agent: Thunderbird 2.0.0.24 (Macintosh/20100228)
MIME-Version: 1.0
To: mrex@sap.com
References: <E1Ovj4f-0007mZ-4a@wintermute02.cs.auckland.ac.nz> <201009151926.o8FJQjWp009193@fs4113.wdf.sap.corp> <8762y55r3c.fsf@mocca.josefsson.org>
In-Reply-To: <8762y55r3c.fsf@mocca.josefsson.org>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Cc: Simon Josefsson <simon@josefsson.org>, tls@ietf.org
Subject: Re: [TLS] Accept draft-turner-ssl-must-not-02 as WG item
Precedence: list

Simon Josefsson wrote:
> Martin Rex <mrex@sap.com> writes:
> 
>> Peter Gutmann wrote:
>>> Martin Rex <mrex@sap.com> writes:
>>>
>>>> Personally I can not think of a reason to move away from what rfc-5246
>>>> appendix E.2 says.
>>> I can.  That language has been in there more or less forever, and it's had
>>> pretty much zero effect in encouraging implementations to drop the SSLv2
>>> handshake (some implementations gradually have over time, but probably not
>>> because of text that says "well, you know, it would be really uncool if you
>>> kept sending SSLv2 hello's for the next twenty years").  Without a clear MUST
>>> NOT for the server to finally get clients to switch off SSLv2 hellos, we're
>>> never going to get rid of these things.
>>  client MUST NOT negotiate or use SSL 2.0  is fine with me
>>  client MUST NOT send SSL 2.0 CLIENT-HELLO is fine with me
>>  server MUST NOT negotiate or use SSL 2.0  is fine with me
>>
>> but
>>
>>  server SHOULD NOT accept SSL 2.0 CLIENT-HELLO as the first message
>>  of a TLS handshake is not sensible and is in clear
>>  conflict with rfc2119 section 6.
> 
> This is exactly my preference too.  Thanks for expressing it so clearly.

I'll update the section to have the three bullets Martin listed above 
(without the "is fine with me" of course).

spt

Re: [TLS] Accept draft-turner-ssl-must-not-02 as … Martin Rex
[TLS] Accept draft-turner-ssl-must-not-02 as WG i… Eric Rescorla
Re: [TLS] Accept draft-turner-ssl-must-not-02 as … Peter Gutmann
Re: [TLS] Accept draft-turner-ssl-must-not-02 as … Paul Hoffman
Re: [TLS] Accept draft-turner-ssl-must-not-02 as … Michael D'Errico
Re: [TLS] Accept draft-turner-ssl-must-not-02 as … Sean Turner
Re: [TLS] Accept draft-turner-ssl-must-not-02 as … Marsh Ray
Re: [TLS] Accept draft-turner-ssl-must-not-02 as … Yoav Nir
Re: [TLS] Accept draft-turner-ssl-must-not-02 as … Peter Saint-Andre
Re: [TLS] Accept draft-turner-ssl-must-not-02 as … Martin Rex
Re: [TLS] Accept draft-turner-ssl-must-not-02 as … Russ Housley
Re: [TLS] Accept draft-turner-ssl-must-not-02 as … Martin Rex
Re: [TLS] Accept draft-turner-ssl-must-not-02 as … Geoffrey Keating
Re: [TLS] Accept draft-turner-ssl-must-not-02 as … Simon Josefsson
Re: [TLS] Accept draft-turner-ssl-must-not-02 as … Sean Turner
Re: [TLS] Accept draft-turner-ssl-must-not-02 as … Sean Turner
Re: [TLS] Accept draft-turner-ssl-must-not-02 as … Martin Rex