Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72519
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.41 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAH8MpnnjTyp=cPBk2BpYF8Rs0x-4kCXw2yWO2pxDuSiiwQ=xDA@mail.gmail.com>
References: <CAH8MpnnjTyp=cPBk2BpYF8Rs0x-4kCXw2yWO2pxDuSiiwQ=xDA@mail.gmail.com>
Date: Wed, 12 Feb 2014 13:39:48 +0000
Message-ID: <CALwr1G=D0fFO0-6xXyxdS1GyT+gkhG-uhOuGf81NuQGV11pvXQ@mail.gmail.com>
To: Daniel Lowrey <rdlowrey@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Future TLS roadmap
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

Hi Daniel,

On 12 February 2014 13:22, Daniel Lowrey <rdlowrey@gmail.com> wrote:
> FYI, these are things I plan to work on for the post-5.6 timeframe:
>
> - Support for SNI in *servers* (currently only supported by clients)
> - Support for DTLS (datagram client/server encryption)
> - Mitigating the client-initiated renegotiation DoS vector in TLS servers
>
> Most TLS changes could probably pass as "security fixes" and may be
> feasible for 5.6 bugfix releases. The alternative is obviously to put the=
m
> in master and wait for 5.7. In any case we can cross that bridge when we
> get there.

I'd support the renegotiation DOS vector as a current bugfix - it's
been documented for what, 2 years now since a POC was published?

Paddy

--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com
Zend Framework Community Review Team
Zend Framework PHP-FIG Representative