Subject: Re: [TLS] Working Group Last Call for draft-ietf-tls-sslv3-diediedie-00

From: Bodo Moeller <[email-masked]>
Date: Wed, 4 Feb 2015 18:03:38 +0100

Joseph Salowey <[email-masked]>:

This is a working group last call for draft-ietf-tls-sslv3-diediedie-00.
> Please reply to the TLS working group list with an indication of whether or
> not the draft is ready for publication and any other comments you may
> have.  Please respond by February 16, 2015.
>

I think that the I-D is essentially ready for publication, and support its
publication as a Standards Track RFC.

(There are a few places where the writing could be improved: it seems a bit
odd, for example, that Section 4 refers to DTLS as a "cryptographic
operation" that SSL 3.0 can't benefit from.  I sort of get the idea, but if
you use non-DTLS TLS, you don't use DTLS anyway, so how does it matter for
DTLS whether non-DTLS TLS handshakes can negotiate SSL 3.0?  However, this
is just a detail in the rationale and doesn't affect the normative
interpretation of the document; its overall message is very clear.)

Bodo

---

From: Martin Thomson <[email-masked]>
Date: Thu, 5 Feb 2015 10:02:13 +1100

> interpretation of the document; its overall message is very clear.)

Hi Bodo,

I've tweaked the text that you pointed out.  If you have any more
quibbles or suggestions, I'm happy to integrate changes in any way
that suits you.  Pull requests are preferred, of course:
https://github.com/tlswg/sslv3-diediedie

---

From: Stephen Checkoway <[email-masked]>
Date: Wed, 4 Feb 2015 22:12:42 -0500

Hi Martin,

This is _super_ minor but I think the security considerations section can be slightly sharpened by changing from "This entire document aims to improve security by identifying a protocol that is not secure." to "This entire document aims to improve security by prohibiting the use of a protocol that is not secure."

But regardless, this I-D seems ready to go and has my support.

-- 
Stephen Checkoway

---

From: Martin Thomson <[email-masked]>
Date: Sat, 7 Feb 2015 11:31:50 +1100

> This is _super_ minor but I think the security considerations section can be slightly sharpened by changing from "This entire document aims to improve security by identifying a protocol that is not…

Thanks, that is better.  Fixed.