Subject: [TLS] I-D Action: draft-ietf-tls-downgrade-scsv-04.txt

From: [email-masked]
Date: Thu, 12 Feb 2015 14:42:35 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Transport Layer Security Working Group of the IETF.

        Title           : TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks
        Authors         : Bodo Moeller
                          Adam Langley
	Filename        : draft-ietf-tls-downgrade-scsv-04.txt
	Pages           : 8
	Date            : 2015-02-12

Abstract:
   This document defines a Signaling Cipher Suite Value (SCSV) that
   prevents protocol downgrade attacks on the Transport Layer Security
   (TLS) protocol.  It updates RFC 2246, RFC 4346, and RFC 5246.  Server
   update considerations are included.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-tls-downgrade-scsv/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-tls-downgrade-scsv-04

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-tls-downgrade-scsv-04

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Bodo Moeller <[email-masked]>
Date: Thu, 12 Feb 2015 23:48:25 +0100

>         Title           : TLS Fallback Signaling Cipher Suite Value (SCSV)
> for Preventing Protocol Downgrade Attacks
>         Authors         : Bodo Moeller
>                           Adam Langley

draft-ietf-tls-downgrade-scsv-04 has editorial changes only, namely the
following, all in response to the various Last Call reviews:

- Abstract: appended "Server update considerations are included." [OPS-Dir
review]

- Introduction: changed "particularly critical if they mean losing the TLS
extension feature (when downgrading to SSL 3.0)" into "particularly harmful
when the result is loss of the TLS extension feature by downgrading to SSL
3.0" [Gen-ART review]

- Introduction: added "a" with the following result: "... is not a suitable
substitute ..." [SecDir review & Gen-ART review]

- Introduction: added "the" with the following result: "... if the TLS
implementations also include support ..." [SecDir review]

- IANA considerations: changed URLs to
http://www.iana.org/assignments/tls-parameters. [IANA review]

Bodo