4 ms·
TLS clients should reject static Diffie-Hellman
- based2 8y ago"We have recently become aware of the publication of the "Middlebox Security Protocol, Part 3: Profile for enterprise network and data centre access control" by ETSI TC CYBER (https://www.etsi.org/deliver/etsi_ts/103500_103599/10352303/01.01.01_60/ts_10352303v010101p.pdf https://www.etsi.org/deliver/etsi_ts/103500_103599/10352303/...), which specifies what it calls "enterprise TLS" or "eTLS." We are writing to express serious concerns about the publication of this specification. This work appears to be related to the previous "mcTLS" work about which we also expressed concerns (https://datatracker.ietf.org/liaison/1538/ https://datatracker.ietf.org/liaison/1538/), and our foremost concern remains the use of a name that implies the aegis of Transport Layer Security (TLS), a well-known protocol which has been developed by the IETF for over twenty years." https://datatracker.ietf.org/liaison/1616/ https://datatracker.ietf.org/liaison/1616/ https://www.heise.de/security/meldung/IETF-an-ETSI-Finger-weg-von-TLS-4245220.html https://www.heise.de/security/meldung/IETF-an-ETSI-Finger-we...