Subject: Re: [TLS] TLS grammar checker?

From: Peter Gutmann <[email-masked]>
Date: Wed, 19 Jun 2013 12:10:58 +0000

Nico Williams <[email-masked]> writes:

>Ad-hoc syntaxes don't lend themselves to automatic tooling, so they tend to
>result in lots of error-prone hand-coding.

That's the problem with the SSL/TLS syntax, it looks like it's specified in a
formal language but it's really more of a specialised notation used to outline
(not always clearly) bits-on-the-wire.  SSH and PGP use a very low-level form
(but still higher-level than TCP's pictorial bit-diagrams), which leads to
even more awkward hand-coded parsers (SSH makes it especially entertaining due
to its arbitrary mixing of binary data and comma-delimited string data).

If I had to do a premortem analysis of my parsing code and arrange it in order
of least to most likely to contain exploitable errors I'd have: ASN.1 -> Large
gap -> SSL/TLS -> SSH.  Not sure where PGP would fit in there, probably
somewhere between SSL/TLS and SSH.

>What are you arguing for?  (Mind you, this really isn't the right place...
>that goes for me too)

Yes it is, flamewars over data-description notations are at least as
interesting as vi vs. emacs, or KDE vs Gnome, or Amiga vs. Atari.

Peter.

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Wed, 19 Jun 2013 14:29:47 +0200 (CEST)

To be honest, I never though that the SSL/TLS syntax is particularly helpful for an implementer nor for someone reading the document.

I wonder whether it would be best to switch to something else in future documents. I don't think that mandating a specific language is particuarly useful either since (as we know from other protocols) there are pros and cons with all of them.

I personally think that a description in natural language is typically best.

Gesendet: Mittwoch, 19. Juni 2013 um 14:10 Uhr

Von: "Peter Gutmann" <[email-masked]>

An: "[email-masked]" <[email-masked]>

Betreff: Re: [TLS] TLS grammar checker?

Peter.

_______________________________________________

TLS mailing list

[email-masked]

https://www.ietf.org/mailman/listinfo/tls