Subject: [ietf-tls] Resubmitting the SSL3 draft (was draft-ietf-tls-kerb-00.txt)

From: David Hopwood <[email-masked]>
Date: Sat, 11 Nov 2000 00:44:47 +0000

-----BEGIN PGP SIGNED MESSAGE-----

Nelson Bolyard wrote:
> BTW, while we're on this topic, would anyone object to the draft [FKK96]
> being submitted as a "historic" or "informational" RFC (not standards
> track) for the purpose of finally having a real IETF RFC that documents
> the existing practice of SSL3?

I think that would be a very good idea (with a pre-amble as suggested
by Jeffrey Altman).

It should probably note the Bleichenbacher attack on PKCS #1
(which is prevented in most newish versions of SSL3 servers), the
{ 0x00,0x1E } conflict, and possibly the 56-bit ciphersuites (which
are also not currently documented in any RFC). It should also
have the "export and single-DES ciphersuites are bad" notice.

- -- 
David Hopwood <[email-masked]>

Home page & PGP public key: http://www.users.zetnet.co.uk/hopwood/
RSA 2048-bit; fingerprint 71 8E A6 23 0E D3 4C E5  0F 69 8C D4 FA 66 15 01
Nothing in this message is intended to be legally binding. If I revoke a
public key but refuse to specify why, it is because the private key has been
seized under the Regulation of Investigatory Powers Act; see www.fipr.org/rip

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]