Re: [TLS] draft-rescorla-tls-renegotiate.txt

[Martin Rex <mrex at sap.com>]

Robert Relyea wrote:
> 
> >> Even more importantly, SSLv3 does not support extensions.
> >>     
> > You're correct.  SSLv3 allows extensions in the ClientHello that
> > are to be ignored, but it does not support them in ServerHello.
>   
> In practice, there are too many servers that blow up even on extensions
> in clientHellos. So many that NSS only uses extensions in TLS, not in SSL3.

I have no data and no experiences about interop issues with >SSLv3.

Networking or multimedia appliances might be the hardest to get
upgraded, although they're quite unlikely themselves to use
client-cert authentication, much less through renegotiation.

We shouldn't unnecessarily create interop-problems with them
(or force them to drop to plain http).


What exactly do you mean by "only uses extensions in TLS"?

TLS extensions must be asserted in the ClientHello, and a SSLv3 server
is expected to ignore them.


Are you rather referring to fallback/reconnect-heuristics in Browsers
that will automatically re-try a failed TLS-handshake with TLS extensions 
by a SSLv3 handshake without TLS extensions.  Which Browsers&Versions
do that, actually (I simply don't know)?

Such a fallback would certainly help, but is entirely an apps issue.
It is much less likely to be present in programmatic clients, I assume.


-Martin