Subject: Re: [TLS] The TLS_FALLBACK_SCSV time bomb (was: Re: Working Group Last Call for draft-ietf-tls-downgrade-scsv-00)

From: Peter Gutmann <[email-masked]>
Date: Fri, 17 Oct 2014 22:28:50 +0000

Andrei Popov <[email-masked]> writes:

>Now that SSL's days are counted, why use SCSV (rather than a TLS extension)?

Counted to what?  Five thousand?  Ten thousand?  That's still a long time to
go.

Peter.

---

From: Andrei Popov <[email-masked]>
Date: Fri, 17 Oct 2014 22:34:36 +0000

I think about 60-90 days or so, for those clients and servers that get regular updates.
 
-----Original Message-----
From: TLS [mailto:[email-masked]] On Behalf Of Peter Gutmann
Sent: Friday, October 17, 2014 3:29 PM
To: <[email-masked]>
Subject: Re: [TLS] The TLS_FALLBACK_SCSV time bomb (was: Re: Working Group Last Call for draft-ietf-tls-downgrade-scsv-00)

>Now that SSL's days are counted, why use SCSV (rather than a TLS extension)?

Counted to what?  Five thousand?  Ten thousand?  That's still a long time to go.

Peter.
_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls

---

From: Hubert Kario <[email-masked]>
Date: Mon, 20 Oct 2014 06:09:22 -0400 (EDT)

----- Original Message -----
> From: "Andrei Popov" <[email-masked]>
> To: "Peter Gutmann" <[email-masked]>, "<[email-masked]>" <[email-masked]>
> Sent: Saturday, 18 October, 2014 12:34:36 AM

There are internet facing servers that support only SSLv2 and yet still get
their certificates refreshed!

I don't think we will see SSLv3 use fall into single digits in this decade.

-- 
Regards,
Hubert Kario
Quality Engineer, QE BaseOS Security team
Email: [email-masked]
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic