Subject: [TLS] Re: Last Call: 'Addition of SEED Ciphersuites to Transport Layer Security (TLS)' to Proposed Standard

From: [email-masked]
Date: Tue, 4 Jan 2005 11:11:10 +0200

This draft defines the following ciphersuites (Section 2):

   CipherSuite TLS_RSA_WITH_SEED_CBC_SHA      = { 0x00,0x60};
   CipherSuite TLS_DH_DSS_WITH_SEED_CBC_SHA   = { 0x00,0x61);
   CipherSuite TLS_DH_RSA_WITH_SEED_CBC_SHA   = { 0x00,0x62);
   CipherSuite TLS_DHE_DSS_WITH_SEED_CBC_SHA  = { 0x00,0x63};
   CipherSuite TLS_DHE_RSA_WITH_SEED_CBC_SHA  = { 0x00,0x64};
   CipherSuite TLS_DH_anon_WITH_SEED_CBC_SHA  = { 0x00,0x65}

These numbers (0x00,0x60..0x65) are already used by various
"EXPORT1024" ciphersuites (expired I-D draft-ietf-tls-56-bit-
ciphersuites). Although that draft never became an RFC, these 
ciphersuites are quite widely implemented (in e.g. OpenSSL, 
Netscape/Mozilla NSS, and some Microsoft and Cisco products), 
so reusing the same numbers is probably not a good idea. 

This conflict was pointed out a while ago on the TLS WG 
mailing list, but apparently the authors didn't notice it.
Based on the list of various TLS numbers I've collected
(http://people.nokia.net/~pasi/tls-numbers.txt), I'd 
suggest renumbering these ciphersuites to 0x00,0x96..0x9B.

Best regards,
Pasi

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Thomas Narten <[email-masked]>
Date: Tue, 04 Jan 2005 13:42:05 -0500

Caveat: I know nothing about TLS registries, per se.

However, more generally, if keeping track of numbers that are in use
is important enough (e.g., to prevent interoperability problems) that
someone has to maintain a private registry, that strongly suggests to
me that IANA should be maintaining such a registry. That is why IANA
exists, after all.

Having IANA maintain the registry doesn't mean it has to be hard to
obtain numbers. They could be assigned FCFS, if that is
appropriate. Indeed, Pasi's page could be used as the initial starting
point with IANA handling all future registrations.

What am I missing?

Thomas

---

From: EKR <[email-masked]>
Date: Tue, 04 Jan 2005 11:22:30 -0800

> point with IANA handling all future registrations.
Nothing. The TLS 1.1 I-D specifies such a registry. It just hasn't
quite wound its way through the process yet.
-Ekr