Re: [TLS] Record layer corner cases

[Martin Rex <martin.rex at sap.com>]

Peter Williams wrote:
> 
> Out of interest Peter and Martin, how well do your software and hardward
> modules handle the following change from SSL v2 to SSL v3, including
> fallback handling as specified by SSL3, and then the TLS fallback
> mechanisms?
>
> "SSL Version 3 supports the transmission and reception of "out of band
> data". Out of band data is normally defined at the TCP/IP protocol level,
> but because of SSL's privacy enhancements and support for block ciphers,
> this becomes difficult to support.

That might be an issue for a generic SSL/TLS toolkit and/or a vendor
implementor thereof.  My employer sells applications and includes
an OEM sslv3 implementation which is used almost exclusively for HTTPS.

I'm not aware that HTTPS specifies a usage of TCP OOB data--and the
document that comes closest to a spec for HTTPS (rfc2818) does not
seem to contain the words "urgent", "out of band" and "OOB".

It might be useful to check whether OOB data has any negative unexpected
side-effects (aka vulnerabilities) besides causing the communication
channel to be closed.

-Martin

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls