Javascript disabled? Like other modern websites, the IETF Datatracker relies on Javascript. Please enable Javascript for full functionality.

Transport Layer Security (TLS) Session Hash and Extended Master Secret Extension
draft-ietf-tls-session-hash-06

Yes

(Barry Leiba)

(Kathleen Moriarty)

(Stephen Farrell)

No Objection

(Alia Atlas)

(Alvaro Retana)

(Ben Campbell)

(Benoît Claise)

(Brian Haberman)

(Deborah Brungard)

(Jari Arkko)

(Joel Jaeggli)

(Spencer Dawkins)

(Terry Manderson)

Note: This ballot was opened for revision 05 and is now closed.

Barry Leiba Former IESG member

(was Discuss) Yes

Yes (2015-05-16 for -05) Unknown

The last paragraph of Section 4 makes me wonder whether this should "update" 5246.  Basically, while this is an extension (which wouldn't normally use "updates"), it's one that you're proposing as standard behavior, and not really as an extension.

Kathleen Moriarty Former IESG member

Yes

Yes (2015-05-08 for -05) Unknown

Thank you for your work on this and a well-written draft!  The considerations are very thorough, every time I had a question, I was able to find an answer in the draft.  I do think a couple more references could be helpful though.

1. I think it would be good for section 6.4 to note that SSL 3.0 has been deprecated in https://datatracker.ietf.org/doc/draft-ietf-tls-sslv3-diediedie/
It's ahead of this draft in the RFC editor queue.

2. It might be good to have a pointer to the UTA TLS Attack RFC7457 as this attack is described in section 2.11 and there is no reference to a fix.  It would be nice to show that known attacks are being resolved. 
https://tools.ietf.org/html/rfc7457#section-2.11

Stephen Farrell Former IESG member

Yes

Yes (for -05) Unknown

Alia Atlas Former IESG member

No Objection

No Objection (2015-05-11 for -05) Unknown

I agree with Barry's question.

Alvaro Retana Former IESG member

No Objection