Subject: Re: [TLS] Confirmation of Consensus on Removing Compression from TLS 1.3

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Sat, 26 Apr 2014 15:24:14 +0000

We have strong confirmation of consensus to remove compression from TLS 1.3.   The Editor is requested to make the appropriate changes to the draft on github.

Joe
[For the chairs]
On Mar 26, 2014, at 11:42 AM, Joe Salowey <[email-masked]> wrote:

> The use of compression within TLS has resulted in vulnerabilities that can be exploited to disclose TLS encrypted application data.   The consensus in the room at IETF-89 was to remove compression from TLS 1.3 to remove this attack vector.  If you have concerns about this decision please respond on the TLS list by April 11, 2014.
> 
> Thanks,
> 
> Joe
> [Speaking for the TLS chairs]

---

From: Eric Rescorla <[email-masked]>
Date: Sat, 26 Apr 2014 08:35:10 -0700

Acknowledged.

I will prepare these changes (and those for the other two issues) as git
pull
requests and notify the list so that people can confirm that the changes
accurately capture the consensus of the WG.

-Ekr

On Sat, Apr 26, 2014 at 8:24 AM, Joseph Salowey (jsalowey) <
[email-masked]> wrote:

> We have strong confirmation of consensus to remove compression from TLS
> 1.3.   The Editor is requested to make the appropriate changes to the draft
> on github.
>
> Joe
> [For the chairs]
> > The use of compression within TLS has resulted in vulnerabilities that
> can be exploited to disclose TLS encrypted application data.   The
> consensus in the room at IETF-89 was to remove compression from TLS 1.3 to
> remove this attack vector.  If you have concerns about this decision please
> respond on the TLS list by April 11, 2014.
> >
> > Thanks,
> >
> > Joe
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Eric Rescorla <[email-masked]>
Date: Sun, 27 Apr 2014 09:05:00 -0700

The pull request is at:

https://github.com/tlswg/tls13-spec/pull/29

Please reply on-list by end of Tuesday 4/29 if you see significant
errors with this change. (Editorial issues can just be submitted
as pull requests to the relevant branch).

Note: if you find an issue after I've merged the change, you can
just submit an issue as usual. That's what revision control is for...

-Ekr