Re: [TLS] Proposal for hybrid solution using most of the ideas

[David-Sarah Hopwood <david-sarah at jacaranda.org>]

Steve Dispensa wrote:
> On 11/18/09 10:10 PM, "David-Sarah Hopwood" <david-sarah at jacaranda.org>
> wrote:
>> Falling back to SSLv3 on a renegotiating handshake is not necessary,
> 
> From the client's perspective, it's an initial negotiation, not a
> renegotiation. 

No, I was referring to handshakes that are renegotiating from the
client's perspective.

>> because the server needs to be patched in order for a renegotiating
>> handshake to succeed. If it is patched, then it is TLS- and
>> extension-tolerant.
> 
> That may be(come) true,

It is true by definition, since a TLS- or extension-intolerant server
wouldn't conform to the spec for the patch.

> but most browsers are currently doing fallback to
> SSLv3 when things go wrong during (initial) negotiation. That code is in the
> apps, not the SSL/TLS libraries.
> 
> For that to become true, you'd have to fix all the servers to handle TLS
> (nontrivial in old code I understand)

No. Servers have to be TLS-tolerant (which later SSLv3 drafts already
required) and to handle one extension; not to support TLS.

> *AND* you'd have to get clients to stop falling back to SSLv3.

That's not correct either. Clients can continue to fall back to SSLv3
provided that they do not both fall back *and* renegotiate (from the
client's point of view) on the same handshake.

> They couldn't stop falling back until the need
> to fall back (i.e., broken TLS server implementations) disappears, which may
> take a long time when you consider old code. It will take another long time
> for browsers to stop falling back.
> 
> By the way, I'm assuming requiring SSLv3 to support the extension is a
> non-starter. I realize it's conceptually straightforward to add, but we're
> talking about adding a major mechanism to the protocol and requiring its use
> immediately and unconditionally.

There's nothing particularly difficult about adding support for one
extension to an SSLv3 server. The extensions spec does not make any
assumptions that hold only for TLS and not SSLv3.

Note that, to head off a possible misconception, we are not talking here
about clients sending extensions in ClientHellos with an SSLv3 record
version. The suggestion is that an SSLv3 server could send an extension
in response to a ClientHello with a TLS record version. This will not
cause any additional interoperability problems, and is not much more
difficult than using any other signalling mechanism.

-- 
avid-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com

Attachment: signature.asc
Description: OpenPGP digital signature