Re: [TLS] Last Call: <draft-ietf-tls-downgrade-scsv-03.txt> (TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks) to Proposed Standard

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, Jan 16, 2015 at 4:04 PM, Bodo Moeller <bmoeller@xxxxxxx> wrote:
> Hanno Böck <hanno@xxxxxxxxx>:
>
>> I think this adds further evidence that adding another workaround layer
>> (SCSV) is the wrong thing to do. Instead browsers should just stop
>> doing weird things with protocols that compromise security and drop
>> the protocol dance completely.
>
> Also, quite clearly, we can't yet know how the TLS 1.3 (1.4, 1.5, ...)
> rollout will work out.
>
The WG should be solving problems that do exist; and not manufactured
problems or theoretical future problems that don't exist.

Jeff





[Index of Archives]     [IETF Annoucements]     [IETF]     [IP Storage]     [Yosemite News]     [Linux SCTP]     [Linux Newbies]     [Fedora Users]