Subject: [TLS] comment on null encryption ciphersuite; https RFC amendment ...to compensate

From: Peter Williams <[email-masked]>
Date: Sat, 18 Nov 2006 18:12:38 -0800

I'm EXTREMELY worried socially about an IAB-endorsement of the null encryption ciphersuite for TLS. Whilst I recognize its value, on the stated merits, I think we need a political balance addressing issues beyond IETF's scope. Too many consumers are potentially going to be duped by the millions of well-meant but potentially incorrect e-commerce website representations  which today affirm that "SSL protects your credit-card data (via encryption etc)". With the use of endorsed null encryption ciphersuites in TLS/SSL, that is obviously not true (in any way grandma would understand). The average consumer is trained to assume "SSL" (or TLS) protects your from obvious criminal activities, concerning pilfering credit card numbers.  IAB activities that destroy the brand name of SSL is something which is not worth the value of endorsing the null-encryption ciphersuite, in my own view.
 
Perhaps the right balance for IAB/IESG is to to require that the https RFC be simultaneously modified so that it makes it NON-CONFORMING for SSL/TLS in the https context to ever use the null encryption ciphersuites. Other URL protocols can be registered with IANA that don't confuse consumers (e.g. httpnos://1.1.1.1.6.5.4.2.0.2.enum.att.com/), which can even behave exactly as https v.10 otherwise does, but allowing for a conforming use of the null-encryption cipher suite. 
 
Peter

From: [email-masked]: [email-masked]: RE: [TLS] IETF67 TLS SummaryDate: Sat, 18 Nov 2006 09:53:44 -0800CC: 
_________________________________________________________________
Express yourself with gadgets on Windows Live Spaces
http://discoverspaces.live.com?source=hmtag1&loc=us

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: EKR <[email-masked]>
Date: Sat, 18 Nov 2006 21:24:09 -0800

Peter,

This isn't an IAB issue. I suggest you raise it with the IESG:

[email-masked]

-Ekr

Peter Williams <[email-masked]> writes:
> I'm EXTREMELY worried socially about an IAB-endorsement of the null
> encryption ciphersuite for TLS. Whilst I recognize its value, on the
> stated merits, I think we need a political balance addressing issues
> beyond IETF's scope. Too many consumers are potentially going to be
> duped by the millions of well-meant but potentially incorrect
> e-commerce website representations which today affirm that "SSL
> protects your credit-card data (via encryption etc)". With the use
> of endorsed null encryption ciphersuites in TLS/SSL, that is
> obviously not true (in any way grandma would understand). The
> average consumer is trained to assume "SSL" (or TLS) protects your
> from obvious criminal activities, concerning pilfering credit card
> numbers.  IAB activities that destroy the brand name of SSL is
> something which is not worth the value of endorsing the
> null-encryption ciphersuite, in my own view.
>
> Perhaps the right balance for IAB/IESG is to to require that the
> https RFC be simultaneously modified so that it makes it
> NON-CONFORMING for SSL/TLS in the https context to ever use the null
> encryption ciphersuites. Other URL protocols can be registered with
> IANA that don't confuse consumers
> (e.g. httpnos://1.1.1.1.6.5.4.2.0.2.enum.att.com/), which can even
> behave exactly as https v.10 otherwise does, but allowing for a
> conforming use of the null-encryption cipher suite.
>  
> Peter
>  
>
>
> http://discoverspaces.live.com?source=hmtag1&loc=us_______________________________________________
> TLS mailing list
> [email-masked]