Subject: [Trans] [trans] #55 (rfc6962-bis): Security Considerations: Describe the implications of clients *not* doing certain optional checks

From: "trans issue tracker" <[email-masked]>
Date: Tue, 06 Jan 2015 10:54:25 -0000

#55: Security Considerations: Describe the implications of clients *not* doing
certain optional checks

 Client behaviour is not mandated in RFC6962-bis - but the list of checks a
 client could do is specified.
 We should document, in the Security Considerations section, what happens
 if a client does not perform each (or some) of these checks.
 For example, the implications of not checking the validity of SCTs or not
 terminating a connection if there are no enough valid SCTs.

 Hopefully this is an acceptable middle-ground between mandating client
 behaviour and not mandating it at all.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |      Owner:  draft-ietf-trans-
  [email-masked]       |  [email-masked]
     Type:  defect       |     Status:  new
 Priority:  major        |  Milestone:
Component:  rfc6962-bis  |    Version:
 Severity:  -            |   Keywords:
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/trans/trac/ticket/55>
trans <http://tools.ietf.org/trans/>

---

From: "trans issue tracker" <[email-masked]>
Date: Tue, 06 Jan 2015 13:59:14 -0000

Comment (by [email-masked]):

 To clarify: This refers both to TLS clients and monitors not doing these
 checks, not just the TLS clients.

 Severity:  -            |  Resolution:
 Keywords:               |

Ticket URL: <http://trac.tools.ietf.org/wg/trans/trac/ticket/55#comment:1>
trans <http://tools.ietf.org/trans/>