Subject: [TLS] Not only TLS compression: where to discuss on CRIME mitigation

From: "KIHARA, Boku" <[email-masked]>
Date: Fri, 26 Oct 2012 22:01:58 +0900

Hello,

I'm writing a draft on CRIME mitigation that might be a guide for
protocol design, implementation, and deployment.
The CRIME attack, I think, is not the fault of TLS compression,
but the fault of the application layer that interlaces sensitive data
and attacker-origin data, because the CRIME attack can applied to
compression other than TLS compression, like HTTP gzip.
My question is which mailing list is appropriate to discuss on CRIME
mitigation. I'm thinking that the outcome might be something like
security considerations of TLS. Anything else?

Regards,
Boku Kihara.

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Fri, 26 Oct 2012 22:09:31 +0000

It seems that the general applies more broadly than TLS and would be of general interest to SAAG (and possibly APPS area).    Countermeasures specific to TLS should be discussed on the TLS list. 
On Oct 26, 2012, at 6:01 AM, KIHARA, Boku wrote:

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: "KIHARA, Boku" <[email-masked]>
Date: Sat, 27 Oct 2012 12:08:59 +0900

> Are you attending the meting in Atlanta?

Yes.

Boku Kihara.

2012/10/27 Joseph Salowey (jsalowey) <[email-masked]>:
> Are you attending the meting in Atlanta?
>
> Joe