Subject: Re: [TLS] Call for Consensus on removal of renegotiation

From: Peter Gutmann <[email-masked]>
Date: Fri, 27 Jun 2014 03:40:45 +0000

Tapio Sokura <[email-masked]> writes:
>On 25.6.2014 23:03, Joseph Salowey (jsalowey) wrote:
>> [Joe] to simplify:
>>
>> 1.  In favor of removing renegotiation
>> 2.  In favor of removing renegotiation with the addition of rekey facility
>> 3.  Not in favor of removing renegotiation
>
>I would choose 1 or 2.

+1.

Peter.

---

From: Peter Gutmann <[email-masked]>
Date: Sat, 28 Jun 2014 10:08:34 +0000

Martin Rex <[email-masked]> writes:

>I think that TLSv1.3 will be largely ignored for many other reasons (except
>maybe by a few (heart)bleeding edge implementations that spend their scarce
>resources to implement every TLS kitchen sink rather than for quality of the
>stuff that is important).

I wish that were true.  Coming from the "other standards that refer to TLS"
world (rather than the "everything's some sort of web-based app" world),
people are going to require use of TLS 1.3 because 1.3 > 1.2.  If you took a
spec for Xmodem with rot13 and called it TLS 1.3 then people writing things
like SCADA standards would be requiring Xmodem/rot13 in all their specs.
That's why I really, really don't want to see a mountain of legacy junk
dragged along into TLS 1.3 because someone's worried that someone, somewhere
may need it.  I really, really don't want to have to shoehorn yet another
gratuitous rework of TLS into a Cortex M3 a year or two after I've finished
doing the last one.

(Another alternative, I guess, is to create an embedded profile of TLS and
hope the standards-writers notice it before they specify the requirement to
support full TLS 1.0, TLS 1.2, TLS 1.3, and also TLS 1.4 just for luck).

Peter.