Subject: RE: [TLS] Last Call: draft-ietf-tls-extractor (Keying Material Exporters for Transport Layer Security (TLS)) to Proposed Standard

From: Bernard Aboba <[email-masked]>
Date: Mon, 27 Jul 2009 10:34:19 -0700

RMS said:

"How should an SDO respond? I'm not sure. I'm only sure that I don't like getting DoSed, either into dropping a standard or into 
not implementing it for fear of infringing."

[BA] A bit of history.  While this draft generalizes the notion of a TLS key material exporters, the concept is basic to key derivation within TLS, as well as within applications depending on TLS.  As an example, DTLS/SRTP as well as TLS-based EAP methods (including EAP-TLS, PEAP, EAP-TTLSv0, EAP-FAST, etc.)  utilize TLS key material export.  So if we only have the option of "dropping the standard" or "not implementing it" then we are left with an unpleasant choice indeed. 

[RMS] "It is better to have no standard than have a standard that invites people into danger."

Outstanding!  Some corollaries: 

It is better to sleep in the outdoors than to live in a house that could fall down in an earthquake. 

It is better to starve than to eat food that could make you sick. 

It is better to walk with bare feet than to wear shoes that could cause blisters. 

It is better to ride a horse than to drive a car that could crash. 

It is better to be wear a blindfold than to watch a movie that could turn out to be unpleasant.

---

From: "Bernard Aboba" <[email-masked]>
Date: Thu, 30 Jul 2009 13:57:07 +0200

I also support publication of this document as a Standards Track RFC.  A
substantial number of existing protocols (including TLS, EAP-TLS, PEAP,
EAP-TTLSv0, DTLS/SRTP and EAP FAST) already utilize the technology in this
document, which has proven quite useful.

---

From: Bernard Aboba <[email-masked]>
Date: Thu, 30 Jul 2009 11:56:16 +0000

I also support publication of this document as a Standards Track RFC.  A substantial number of existing protocols (including TLS, EAP-TLS, PEAP, EAP-TTLSv0, DTLS/SRTP and EAP FAST) already utilize the technology in this document, which has proven quite useful.