Subject: [secdir] secdir review of draft-mavrogiannopoulos-ssl-version3

From: "Dan Harkins" <[email-masked]>
Date: Mon, 2 May 2011 10:52:30 -0700 (PDT)

Hello,

  I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

  This draft is a formal description of SSL 3.0 which was never formally
published by the IETF. TLS has made it obsolete but having a stable
reference would be valuable, so it's being published as historical.

  This is a very well-written draft (I wish more I-Ds were written this
clearly, my own included). It notes, in the Foreward, that no changes
from the original SSL 3.0 document were made except to remove portions
that no longer apply and a few trivial editorial changes. I would like to
suggest some changes that I believe would fall into those buckets as well.

  Trivial editorial changes to give normative behavior normative wording:
   - section 5.6.1.1 Hello request, "After sending a hello request,
     servers SHOULD NOT repeat the request...."
   - section 5.6.1.2 Client hello after description of the contents
     of the SessionID, "Warning: Servers MUST NOT place confidential
     information in session identifiers, and MUST NOT let the contents
     of fake session identifiers cause any breach of security."
   - section 5.6.4, Certificate request, "Note: An anonymous server
     requesting client information MUST result in a fatal
     handshake_failure alert."
   - section 5.6.9, Finished, "It SHALL be a fatal error if a finished
     message is not preceded [spelling?] by by a change cipher spec
     message at the appropriate point in the handshake."

  Removal of wording that no longer applies in the current environment
  (and was not really unique to the US anyway):
   - section 5.6.3, remove note about US export law restricting RSA
     moduli to 512 bits or less.
   - Appendix D.1, remove mention of US export restrictions limiting
     RSA keys used for encryption to 512 bits.

  Trivial editorial change to conform to RFC structure
   - make section 7 into section 8 and move Appendix F into a new
     section 7 entitled "Security Considerations".

  regards,

  Dan.

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Wed, 11 May 2011 14:59:59 +0200

> these comments just like any other last call comments.

Hello and thank you for reviewing the document.

[...]
>  Trivial editorial changes to give normative behavior normative wording:
[applied]

>     RSA keys used for encryption to 512 bits.

I think it is essential to the document the US export restrictions to be kept
as it is. My reasoning would be:
1. To keep the discussion in context, and answer to the question why the export
ciphersuites are defined?
2. To show that cryptography at that time (1998) was driven from political
decisions.

For this reason I suggest instead the following text to the foreword:
"The US export rules discussed in the document do not apply today
but are kept intact for to provide context for the
discussion of the EXPORT cipher-suites."

>     section 7 entitled "Security Considerations".

Although this is today the current format, it was not in 1998 and
this document is already widespread through copies such as
www.mozilla.org/projects/security/pki/nss/ssl/draft302.txt. For this
reason I'd like to keep the differences between the two documents
as minimal as possible.

best regards,
Nikos