On Tuesday, 20 September 2016 18:24:42 CEST David Benjamin wrote: > On Tue, Sep 20, 2016 at 2:14 PM Hubert Kario <hka...@redhat.com> wrote: > > I'll be running test looking for intolerances like this over the Alexa top > > 1 > > million next month. > > (I've already done this, by the way. It's where the numbers in the version > negotiation thread came from.)
even if there is no glory in it, reproducibility studies are important in scientific approach :) > > For now I have a probe that adds values 0x0003, 0x0004, 0x0700, 0x0703 and > > 0x0704 at the end of the list of algorithms. > > At the front is probably more realistic. good point > There is even a MUST-level > requirement in the current TLS 1.3 spec for SHA-1 sigalgs to be at the end, > so the new ones can't be (unless you take SHA-1 out, which is, sadly, > unrealistic today... an upsetting number of 1.2 servers only sign SHA-1). yes, I see around 5% of servers doing that > I was able to find a few instances of an NSS bug ( > https://bugzilla.mozilla.org/show_bug.cgi?id=1119983), but nothing else. > > The offending implementation for this thread was actually a WebRTC stack > (DTLS), not an HTTPS server. We hit it via Chrome's Dev channel. But since > this intolerance comes from a MUST-level requirement in TLS 1.2, I think > it's prudent to renumber. True, but then we should check if we don't hit even bigger problems. -- Regards, Hubert Kario Senior Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic
signature.asc
Description: This is a digitally signed message part.
_______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
