Re: [TLS] Cipher suite values to indicate TLS capability

Adam Langley <agl@google.com> Tue, 05 June 2012 21:23 UTC

MIME-Version: 1.0
In-Reply-To: <CAL9PXLwdQctUub5oPx0tepsfveDo0bNKGBUaUBBFeq4u4D0BbA@mail.gmail.com>
References: <CAL9PXLwdQctUub5oPx0tepsfveDo0bNKGBUaUBBFeq4u4D0BbA@mail.gmail.com>
Date: Tue, 05 Jun 2012 17:23:11 -0400
Message-ID: <CAL9PXLzQ5b1+9DH44SnJwAQ1eMx3mBYpGrSpU2vT+4P7Gb3MMg@mail.gmail.com>
From: Adam Langley <agl@google.com>
To: tls@ietf.org
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [TLS] Cipher suite values to indicate TLS capability
Precedence: list

wtc pointed out
http://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-version-cs.txt
from last year. I didn't build on that because it didn't seem to go
anywhere, sadly.

Although it's worth noting that my previous comment:

"This doesn't really make the deployment of new TLS versions that much
easier. The client would still have to try 1.2, 1.1, 1.0 etc. What
would be helpful is if the server, seeing a TLS 1.2 SCSV, treated the
client as if it has advertised 1.2."

Has turned out to be false. We're now aware of networks which filter
on the version in the returned ServerHello.

Yngve's point about just using the renegotiation extension as an
indication, client-side, that we shouldn't have done a fallback is
still a possibility.


Cheers

AGL

Re: [TLS] Cipher suite values to indicate TLS cap… Geoffrey Keating
[TLS] Cipher suite values to indicate TLS capabil… Adam Langley
Re: [TLS] Cipher suite values to indicate TLS cap… Adam Langley
Re: [TLS] Cipher suite values to indicate TLS cap… Geoffrey Keating
Re: [TLS] Cipher suite values to indicate TLS cap… Adam Langley
Re: [TLS] Cipher suite values to indicate TLS cap… Adam Langley
Re: [TLS] Cipher suite values to indicate TLS cap… Geoffrey Keating
Re: [TLS] Cipher suite values to indicate TLS cap… Adam Langley
Re: [TLS] Cipher suite values to indicate TLS cap… Chris Richardson
Re: [TLS] Cipher suite values to indicate TLS cap… Wan-Teh Chang
Re: [TLS] Cipher suite values to indicate TLS cap… Yoav Nir
Re: [TLS] Cipher suite values to indicate TLS cap… Yoav Nir
Re: [TLS] Cipher suite values to indicate TLS cap… Nikos Mavrogiannopoulos
Re: [TLS] Cipher suite values to indicate TLS cap… Geoffrey Keating
Re: [TLS] Cipher suite values to indicate TLS cap… Chris Richardson
Re: [TLS] Cipher suite values to indicate TLS cap… Tom Ritter
Re: [TLS] Cipher suite values to indicate TLS cap… Nikos Mavrogiannopoulos
Re: [TLS] Cipher suite values to indicate TLS cap… Adam Langley
Re: [TLS] Cipher suite values to indicate TLS cap… Nikos Mavrogiannopoulos
Re: [TLS] Cipher suite values to indicate TLS cap… Adam Langley
Re: [TLS] Cipher suite values to indicate TLS cap… Martin Rex