Subject: Re: [TLS] SCSV vs RI when both specified. Was: Updated draft

From: "Blumenthal, Uri - 0662 - MITLL" <[email-masked]>
Date: Sat, 19 Dec 2009 08:24:14 -0500

You're saying it's not important whether the protocol spec demands aborting the connection or not?!  As long as the processing amount to arrive at the decision is about the same?

And yes I would hold the publication to clear up this issue.

----- Original Message -----
From: [email-masked] <[email-masked]>
To: TLS Mailing List <[email-masked]>
Sent: Sat Dec 19 03:46:45 2009
Subject: Re: [TLS] SCSV vs RI when both specified. Was: Updated draft

On Dec 18, 2009, at 1:02 PM, Michael D'Errico wrote:

> My two sentences describe everything you need to know:
>
>   SCSV absent,  RI absent:   hide the kids
>   SCSV absent,  RI present:  same as RI
>   SCSV present, RI absent:   same as empty RI
>   SCSV present, RI present:  same as RI (SCSV ignored)
>
> Why do you want the last one to be "ABORT!!"?

It's pretty clear (to me) that it doesn't matter if the last one is  
allowed or not, as long as the spec makes a clear decision. It's  
roughly the same amount of code (plus or minus a conditional and an  
alert). The four conditions have to be tested regardless of how it's  
defined.

Is this point really so important that it's worth holding up  
publication and subsequent implementation? I say it is not.

-- 
Steve Checkoway

     "Anyone who says that the solution is to educate the users
     hasn't ever met an actual user." -- Bruce Schneier

---

From: Steve Checkoway <[email-masked]>
Date: Sat, 19 Dec 2009 15:20:25 -0800

On Dec 19, 2009, at 5:24 AM, Blumenthal, Uri - 0662 - MITLL wrote:

> You're saying it's not important whether the protocol spec demands aborting the connection or not?!  

As long as the spec is clear about what to do in that case (either abort or not), it doesn't really matter what the decision is. The code is about the same. The amount of testing is identical as far as I can tell.

> As long as the processing amount to arrive at the decision is about the same?

I don't know what this means.

-- 
Steve Checkoway