Subject: [ietf-tls] Re: London

From: "Joseph Hui" <[email-masked]>
Date: Thu, 12 Jul 2001 12:25:28 -0700

David,

Thanks for shedding light on Microsoft's position on the dns_name
extension.  

Taking it as good faith from a major vendor to implement dns_name 
in due time, hopefully soon, I think the TLS revision number has
just become academic, from a CDN's vantage point.  

Maybe now it's a good time to bring up an issue of compatibility
that may cause grief during the dns_name roll-out: 

   dsn_name-server     : dns_name-browser,     works;
   dns_name-server     : non-dns_name-browser, doesn't work;
   non-dns_name-server : dns_name-browser,     doesn't work;
   non-dns_name-server : non-dns_name-browser, doesn't work.

IMHO, Microsoft can do lots of good to help mitigate the migration pain
as we move onto the dns_name-servers:dns_name-browsers world, like
launching the dns_name feature in IE server and browser simultaneously.

Regards,

Joe Hui
Digital Island
====================================================================
-----Original Message-----
From: David Mowers [mailto:[email-masked]]
Sent: Thursday, July 12, 2001 11:09 AM
To: IETF Transport Layer Security WG
Subject: [ietf-tls] Re: London

First, an introduction: I took over Program Manager responsibilities for
SChannel, Microsoft's implementation of SSL/TLS, last year. I work with
John Banes, our principal Developer for SSL/TLS, in the Windows Security
team. As I settle into my position here at Microsoft, I am looking
forward to taking a more active role in this working group and helping
out where possible in the ongoing efforts to improve TLS.

Back to the issue: It's hard to predict when Microsoft will implement
and deploy the dns_name extension although it is getting a very close
look. I don't think that incrementing the version number will have much
of an effect either way, though, so don't let that turn into a blocking
issue.

Deploying this change in the context of HTTP over TLS (HTTPS) is going
to take some time. Changing the format of the client_hello message has
historically caused lots of grief and various compatibility problems.
There are a lot of internet servers out there and just testing against
them all is a very large effort. 

I think this change is worth doing, but it is going to take some time.

David Mowers
Program Manager
Windows Security

-----Original Message-----
From: Eric Rescorla [mailto:[email-masked]]
Sent: Thursday, July 05, 2001 1:46 PM
To: IETF Transport Layer Security WG
Subject: [ietf-tls] Re: London

"Joseph Hui" <[email-masked]> writes:
> Incrementing the minor number may complicate whatever somehow.
> But it would certainly "uncomplicate" to great extent the task
> of convincing browser/server vendors to adopt dns_name quickly.
> The fact of matter is: the vendors are not direct beneficiaries
> of dns_name, so they need some extra incentives to move. 
> If we can't tempt them with greed (as all browsers are free), 
> then fear -- the fear of falling behind one TLS revision -- is
> the obvious alternative.
I see no reason to believe that incrementing the version number
will have this effect. Perhaps the representatives from Microsoft
and Netscape would be so good as to offer an opinion here.

-Ekr

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to
[email-masked]

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to
[email-masked]

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]