Subject: [TLS] AD review of draft-ietf-tls-sslv3-diediedie-02

From: Stephen Farrell <[email-masked]>
Date: Mon, 16 Mar 2015 23:20:46 +0000

Hiya,

I got the publication request for this a couple of weeks
ago. Sorry for being slow. (#include <usualexcuses.h>)

Good to (start to) see the back of this, thanks.

I've started IETF LC as I only had nits to note. The
announcement should pop out soonish.

Those nits are:

- ID nits sez you should say in the abstract that you're
updating 5246 and that prohibiting-rc4 is now RFC 7465.
It also wants you to add the usual 2119 boilerplate.
I noted those in the LC text so presumably we can fix 'em
later if needed.

- abstract: (philosophical nit:-) is "no longer secure"
correct - I guess it was never secure, it's just we've now
discovered exactly how and why.  The same point arises in
the intero, in that ssl2 is "no longer considered secure" -
I think you mean "sufficiently secure" in both cases.

Those can be fixed during/after IETF LC if need be.

Cheers,
S.

---

From: Martin Thomson <[email-masked]>
Date: Mon, 16 Mar 2015 16:54:15 -0700

> I noted those in the LC text so presumably we can fix 'em

Why can't "MUST" be assumed in the same way that "TCP" is, I ask?

A question that is perfectly suited to the upcoming plenary, methinks.
Bike sheds are always best painted in large groups.

(I've fixed the editor's copy, BTW.)

> I think you mean "sufficiently secure" in both cases.

Fine with me.  Updated.