Subject: Re: [saag] Comments on draft-turner-ssl-must-not-01

From: Sean Turner <[email-masked]>
Date: Thu, 01 Jul 2010 15:50:42 -0400

>> - The draft should talk a bit about deployment considerations, not 
>> just security. During the RI episode, there were numbers mentioned 
>> (published?) about the prevalence of different protocol versions. This 
>> is certainly relevant to the current discussion, and readers would 
>> benefit from having these statistics included.

I'll dig up the emails and include a reference to the statistics.

>> - Speaking about which, I'm surprised the draft does not mention that 
>> support of RFC 5746 (RI) is mandatory. After all this one has a 
>> practical exploit, which I'm not sure is the case for other security 
>> issues mentioned here.

A glaring oversight on my part.

>> - The reference to the original Netscape spec is kind of useless. 
>> Please also mention that it was published as an I-D, still available 
>> at http://tools.ietf.org/html/draft-ietf-tls-ssl-version3-00. 
>> <http://tools.ietf.org/html/draft-ietf-tls-ssl-version3-00>

I'll point to this I-D instead.

>> - The document provides some motivation on why TLS 1.1 is a SHOULD. 
>> However it RECOMMENDS TLS 1.2 (which today is very rarely implemented, 
>> AFAIK) and does not provide any motivation for that. I would say the 
>> document as written only supports a statement like "use of TLS 1.1 or 
>> higher is RECOMMENDED."

I was thinking that we really need to be recommending the latest and 
greatest.  I mean it was developed for a reason right?  Based on Nikos 
these recommendations will probably get tweaked.

spt

---

From: Yaron Sheffer <[email-masked]>
Date: Fri, 02 Jul 2010 12:00:54 +0300

Hi Sean,

we should be "recommending" the latest and greatest. But when we are 
"RECOMMENDING" (all caps), it's really a RFC 2119 SHOULD, and we need 
stronger justification than the draft being nice and shiny.

Thanks,
	Yaron

On 07/01/2010 10:50 PM, Sean Turner wrote:
>>> (published?) about the prevalence of different protocol versions.
>>> This is certainly relevant to the current discussion, and readers
>>> would benefit from having these statistics included.
>
>>> However it RECOMMENDS TLS 1.2 (which today is very rarely
>>> implemented, AFAIK) and does not provide any motivation for that. I
>>> would say the document as written only supports a statement like "use
>>> of TLS 1.1 or higher is RECOMMENDED."
>