[TLS] Weekly github digest (TLS Working Group Drafts)

2020-10-04 Thread Repository Activity Summary Bot
Issues -- * tlswg/draft-ietf-tls-esni (+3/-2/💬28) 3 issues created: - Tidy up all codepoints before -08 (by chris-wood) https://github.com/tlswg/draft-ietf-tls-esni/issues/322 - legacy_session_id should match between inner and outer (by davidben) https://github.com/tlswg/draft-iet

[TLS] Fwd: Re: AD review of draft-ietf-tls-dtls-connection-id-07

2020-10-04 Thread Achim Kraus
Hi Ben, any progress on the cid-length / calculate MAC topic? As I wrote, though the cid-length itself is not "on the wire" (it's only the cid), I can't see, that the cid-length could be injected. Do I oversee soemthing? best regrads Achim Kraus Weitergeleitete Nachricht Betr

[TLS] Test Server update

2020-10-04 Thread Michael D'Errico
BTW, if anybody is hoping I'll update my test server to support TLS 1.3, I am not going to be doing that. Version 1.3 is broken and I don't think anybody should use it. Mike ___ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls

[TLS] Un-deprecating everything TLS 1.2

2020-10-04 Thread Michael D'Errico
Hi, I'm pretty sure TLS 1.3 is completely broken. Can we please stop deprecating things that TLS 1.2 uses and make them all Recommended again? Mike ___ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls

Re: [TLS] Is stateless HelloRetryRequest worthwhile? (was Re: TLS 1.3 Problem?)

2020-10-04 Thread Luke Curley
Mike, The server receives a ClientHello from a prospective client. In the case of DTLS and QUIC, this path has not yet been validated, so the server may want to verify the remote address prior to continuing the handshake. This is incredibly important as generating key_shares and signing the transc

Re: [TLS] Un-deprecating everything TLS 1.2

2020-10-04 Thread Salz, Rich
Mike, I suggest you make sure you understand the analyses (plural) that have been done. You are very far in the minority here. Even some folks who say "we don't need these features," but nobody else has said "this is not secure." This is not to say that the RFC could not be improved, and gain