GnuTLS: fix $tls_out_ocsp under hosts_request_ocsp

[users/jgh/exim.git] / doc / doc-txt / experimental-spec.txt

diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt
index 211841f3f0e02dd552519d8539cc365f8959e40d..301152f1a91a77f6d6317f566b944703effa04da 100644 (file)
--- a/doc/doc-txt/experimental-spec.txt
+++ b/doc/doc-txt/experimental-spec.txt
@@ -984,7 +984,10 @@ Security aspects:
  vulnarability surface.  An attacker able to decrypt it would have access
  all connections using the resumed session.
  The session ticket encryption key is not committed to storage by the server
  vulnarability surface.  An attacker able to decrypt it would have access
  all connections using the resumed session.
  The session ticket encryption key is not committed to storage by the server

- and is rotated regularly.  Tickets have limited lifetime.
+ and is rotated regularly (OpenSSL: 1hr, and one previous key is used for
+ overlap; GnuTLS 6hr but does not specify any overlap).
+ Tickets have limited lifetime (2hr, and new ones issued after 1hr under
+ OpenSSL.  GnuTLS 2hr, appears to not do overlap).

 
  There is a question-mark over the security of the Diffie-Helman parameters
  used for session negotiation. TBD.  q-value; cf bug 1895
 
  There is a question-mark over the security of the Diffie-Helman parameters
  used for session negotiation. TBD.  q-value; cf bug 1895


@@ -993,17 +996,16 @@ Observability:
  New log_selector "tls_resumption", appends an asterisk to the tls_cipher "X="
  element.
 
  New log_selector "tls_resumption", appends an asterisk to the tls_cipher "X="
  element.
 

- Variables $tls_{in,out}_resumption have bit 0-4 indicating respectively
+ Variables $tls_{in,out}_resumption have bits 0-4 indicating respectively

  support built, client requested ticket, client offered session,
  server issued ticket, resume used.  A suitable decode list is provided
  in the builtin macro _RESUME_DECODE for ${listextract {}{}}.
 
 Issues:
  In a resumed session:
  support built, client requested ticket, client offered session,
  server issued ticket, resume used.  A suitable decode list is provided
  in the builtin macro _RESUME_DECODE for ${listextract {}{}}.
 
 Issues:
  In a resumed session:

-  $tls_{in,out}_certificate_verified will be unset (undler OpenSSL)
-  verify = certificate will be false (undler OpenSSL)

   $tls_{in,out}_cipher will have values different to the original (under GnuTLS)
   $tls_{in,out}_cipher will have values different to the original (under GnuTLS)

-  $tls_{in,out}_ocsp will be "not requested" or "no response"
+  $tls_{in,out}_ocsp will be "not requested" or "no response", and
+   hosts_require_ocsp will fail

 
 
 --------------------------------------------------------------
 
 
 --------------------------------------------------------------