Subject: [wpkops] TLS stack anomalies in scope?

From: Tim Moses <[email-masked]>
Date: Fri, 14 Dec 2012 21:11:29 +0000

Colleagues.  There is a question over whether the results of Adam Langley's work on anomalous bahaviour in common TLS stack implementations is in or out of scope for the WPKOPS activity, and whether the draft charter properly reflects the answer to that question.  There have been no objections that I am aware of to including the work.  It merely remains to ensure that the charter makes it clear.

I propose adding the following statement to the list of example problems:

"Finally, varying interpretations of the protocol specifications and implementation errors result in interoperability failures and introduce security vulnerabilities in the TLS stack."

Do people think this is sufficient, or is a more radical rewrite called for in which the emphasis is on TLS and its supporting infrastructure?

All the best.  Tim.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 14 Dec 2012 16:21:35 -0500

I don't see a problem with it. Understanding the muck at the bottom of that
swamp is one of the principal concerns.

On Fri, Dec 14, 2012 at 4:11 PM, Tim Moses <[email-masked]> wrote:

> Colleagues.  There is a question over whether the results of Adam
> Langley's work on anomalous bahaviour in common TLS stack implementations
> is in or out of scope for the WPKOPS activity, and whether the draft
> charter properly reflects the answer to that question.  There have been no
> objections that I am aware of to including the work.  It merely remains to
> ensure that the charter makes it clear.
>
> "Finally, varying interpretations of the protocol specifications and
> implementation errors result in interoperability failures and introduce
> security vulnerabilities in the TLS stack."
>
> Do people think this is sufficient, or is a more radical rewrite called
> for in which the emphasis is on TLS and its supporting infrastructure?
>
> All the best.  Tim.
> _______________________________________________
> wpkops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/wpkops
>

-- 
Website: http://hallambaker.com/

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 14 Dec 2012 16:34:01 -0800

> Do people think this is sufficient, or is a more radical rewrite called for in which the emphasis is on TLS and its supporting infrastructure?

Neither. The rest of the WPKOPS charter is, in fact, about the "PK" part of the acronym. That's good. If you want to have a document on how the TLS stack today deals with PKI, then just say "This document will cover how the TLS stack today deals with PKI, including varying interpretations and implementation errors".

This is also a good way to deal with the "visible state changes" that the WG wanted to deal with. That would then change the sentence to "This document will cover how the TLS stack today deals with PKI, including varying interpretations and implementation errors, as well as state changes visible to the user".

--Paul Hoffman