Subject: Re: [TLS] padding bug

From: Peter Gutmann <[email-masked]>
Date: Tue, 24 Sep 2013 05:01:40 +0000

Eric Rescorla <[email-masked]> writes:

>These messages from Nikos look negative to me:
>http://www.ietf.org/mail-archive/web/tls/current/msg09809.html
>http://www.ietf.org/mail-archive/web/tls/current/msg09520.html

That's just Nikos complaining (as Ben Laurie put it, "I've seen no objection
that makes any sense").  I've just responded to Nikos yet again, see my
message of a few minutes ago.

>We think this would benefit from F2F discussion and I would invite you or
>someone else in favor of this draft (or another approach) to present in
>November in Vancouver. If there is WG consensus for this, we can adopt it
>then.

Well if you guys are willing to pay my air fares to Canada to repeat, yet
again, all the stuff that's already been gone through on the list, then I
guess I can do it.

This work has been stalled now since the start of the year.  Nothing else has
moved forward.  So it's not a matter of chosing between several competing
viable proposals, it's a choice between (A) "adopt a simple fix for a decade-
old problem that's been repeatedly exploited" and (B) "don't fix the problem,
allowing further exploitation in the future".

I want to apply the simple fix, and I get the feeling the rest of the WG does
too.  It appears that the WG chairs don't care about fixing it, or at least in
nine months they've shown no interest in moving it forward.

So I'd like to adopt Ben's proposal:

  How about we take a vote?

Could people please indicate on the list whether they'd prefer option (A), fix
the problem with EtM, or option (B), which appears to be "do nothing", or at
least "delay indefinitely", which amounts to the same thing.

Peter.

---

From: "Christian Kahlo" <[email-masked]>
Date: Tue, 24 Sep 2013 07:08:31 +0200

> Could people please indicate on the list whether they'd prefer option
> (A), fix the problem with EtM, or option (B), which appears to be "do
> nothing", or at least "delay indefinitely", which amounts to the same
> thing.

[X] A

-Christian

-- 
Christian Kahlo, Research Manager IT-Security, http://www.ageto.de
[email-masked], Tel. +49-3641-3678-305, Fax +49-3641-3678-101
AGETO Innovation GmbH, Winzerlaer Straße 2, D-07745 Jena
Geschäftsführung: P. Israel, S. Sauer, S. Scheppe HR: Amtsgericht Jena, HRB
210399

---

From: Kelly John Rose <[email-masked]>
Date: Tue, 24 Sep 2013 16:09:15 -0400

If I may be permitted to vote, I would say A.

-- 
Kelly John Rose
Mississauga, ON
Phone: +1 647 638-4104
Twitter: @kjrose

Document contents are confidential between original recipients and sender.