Subject: Re: [keyassure] Hashing certificates vs hashing keys

From: "Jeffrey A. Williams" <[email-masked]>
Date: Wed, 15 Dec 2010 12:00:24 -0600 (GMT-06:00)

Martin and all,

  More and more there are org's that are desiring
to do more through the browser.  But as you rightly
point out it's often done wrong or poorly.  Still
this trend is not going away.

-----Original Message-----
>From: Martin Rex <[email-masked]>
>Sent: Dec 14, 2010 4:04 PM
>To: Adam Langley <[email-masked]>
>Cc: [email-masked]
>Subject: Re: [keyassure] Hashing certificates vs hashing keys
>
>Adam Langley wrote:
>> 
>> On Tue, Dec 14, 2010 at 2:18 PM, Martin Rex <[email-masked]> wrote:
>> > TLS implementations that send out incomplete or unordered certificate
>> > chains are clearly violating the TLS protocol specification and
>> > those that are sending expired certificate deserve to face a
>> > fatal certficate expired alert.
>> 
>> Yes, I agree. However all the economic incentives push clients towards
>> maximum compatibility and don't encourage server operators to fix
>> anything.
>
>If Browsers implement the "workarounds" that you described in a
>completely covert fashion, then they are actually making the problem
>MUCH worse _and_ make it last MUCH longer.
>
>There are a number of folks that do black-box testing with browsers
>only, and what the particular browser that is used does not report
>as an error is considered "fine".
>
>Silently forgiving just about _everything_ with a smile is a sure way
>to spoil kids and technologies.
>
>
>More and more often I'm seeing support calls "but it works in the browser",
>and I'll have to ask for a network trace -- in order to confirm that
>our TLS client in compliance with the spec and that they need to
>get the server fixed if they want to connect/interoperate.  And our
>client is pretty conservative in what it sends out (e.g. no TLS extensions).
>
>
>
>-Martin
>_______________________________________________
>keyassure mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/keyassure

Regards,
Jeffrey A. Williams
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
Network Eng. SR. Eng. Network data security
ABA member in good standing member ID 01257402 
E-Mail [email-masked]
Phone: 214-244-4827