Subject: [Uta] TLS BCP SSL v3 == TLS 1.0

From: Trevor Freeman <[email-masked]>
Date: Wed, 28 May 2014 18:15:57 +0000

I am curious why the draft treats SSL v3 (SHOULD NOT) differently to TLS v1.0 (MAY)

>From a security perspective, they are equivalent in that they are no significant threats mitigated by TLS 1.0.

TLS 1.0 is still vulnerable to the BEAST attack so it should be a SHOULD NOT like SSL v3.

Given the vulnerability of these versions to the BEAST attack, we should set a date to flip then from SHOUND NOT to MUST NOT to send a stronger message to stop using these versions.

Trevor

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 28 May 2014 12:47:52 -0600

> I am curious why the draft treats SSL v3 (SHOULD NOT) differently to TLS

We received feedback about that at the London meeting and haven't 
incorporated it yet.

>  From a security perspective, they are equivalent in that they are no
> significant threats mitigated by TLS 1.0.
>

Ack.

> Given the vulnerability of these versions to the BEAST attack, we should
> set a date to flip then from SHOUND NOT to MUST NOT to send a stronger
> message to stop using these versions.

IMHO it's not the function of this document to be setting flag days.

Peter

---

From: Trevor Freeman <[email-masked]>
Date: Wed, 28 May 2014 20:45:01 +0000

-----Original Message-----
From: Peter Saint-Andre [mailto:[email-masked]] 
Sent: Wednesday, May 28, 2014 11:48 AM
To: Trevor Freeman; [email-masked]
Subject: Re: [Uta] TLS BCP SSL v3 == TLS 1.0

On 5/28/14, 12:15 PM, Trevor Freeman wrote:
> I am curious why the draft treats SSL v3 (SHOULD NOT) differently to 
> TLS
> v1.0 (MAY)

We received feedback about that at the London meeting and haven't incorporated it yet.

Ack.

> Given the vulnerability of these versions to the BEAST attack, we 
> should set a date to flip then from SHOUND NOT to MUST NOT to send a 
> stronger message to stop using these versions.

IMHO it's not the function of this document to be setting flag days.
[TF] The document is supposed to be defining best practice. That seems hard to reconcile with unbounded continued use of a protocol with a known vulnerability. If you don't want to set a date, why not flip the SHOULD to MUST? That may mean some are not compliant with best practice but is clarifies the position on use of protocols with vulnerabilities. 

Peter

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Fri, 30 May 2014 16:10:57 +0200

On Wed, 2014-05-28 at 18:15 +0000, Trevor Freeman wrote:
> TLS v1.0 (MAY)

Not really.
1. SSL 3.0 does not check the padding bytes in CBC, and thus allows for
far more efficient attacks.
2. SSL 3.0 uses a non-standard MAC (pre-HMAC) variant and can only be
combined with SHA1 or MD5 based algorithms.

> TLS 1.0 is still vulnerable to the BEAST attack so it should be a

I agree.

regards,
Nikos