Subject: [TLS] rfc 6520 TLS heartbeat feature

From: Jitendra Lulla <[email-masked]>
Date: Wed, 6 Dec 2017 05:05:52 +0000 (UTC)

Hi,

As tls 1.3 is being worked upon, older work like rfc 6520 and any enhancements to it may not be as important.

Also, particularly the TLS heartbeat feature, which has become famous for wrong reasons, is disabled by the SSL implementations eg OpenSSL.

I tried to uncover an issue below pertaining to the heartbeat messages here:

https://www.mail-archive.com/[email-masked]/msg47273.html

Experts struggle to find any significant use of this feature for both the TLS and DTLS. 

I am planning to propose enhancements which will include restricted issuance of the heartbeat requests (wrt size and frequency)  to avoid the exploit mentioned in the link above. A stronger standard will trigger bug/vulnerability free implementations. 

I would like to know if  enhancements to this rfc are welcomed or it is there to be abandoned completely? 

In other words, is it worth spending time?

Thanks
Jitendra

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 6 Dec 2017 14:07:55 +0000

➢ In other words, is it worth spending time?
    
You might find it worthwhile to look at Peter’s “LTS for TLS” draft.

 Nobody cares about heartbeats and for this issue, that’s probably good enough.