Subject: Re: [saag] POODLE in detail (was Re: NTP security, and thoughts on Hawaii)

From: Peter Gutmann <[email-masked]>
Date: Tue, 4 Nov 2014 18:33:40 +0000

ianG <[email-masked]> writes:
>On 4/11/2014 08:09 am, Yoav Nir wrote:
>> I think this has little to do with the TLS working group. ...
>> Whether the market will use them is up to the market, not us.
>
>That may be the way IETF thinks.  Meanwhile, there are great swathes of
>industry that think this way:
>[...]

Not all of industry thinks this way, see e.g.
http://techblog.netflix.com/2014/10/message-security-layer-modern-take-on.html.

(While I agree with their reasoning, they then go off into the weeds and
decide to invent their own security protocol rather than just taking TLS and
throwing out the PKI stuff that's causing them all the pain).

Interesting challenge for the TLS WG: What would you say to these guys to get
them to go with TLS 1.3 rather than inventing their own protocol?  These are
serious, major scale users who aren't brower vendors or Google, what's in it
for them?  Sell me this pen^H^H^Hprotocol.

Peter.