[TLS] Opera 10.50 alpha snapshot with TLS Renego extension support

["Yngve N. Pettersen (Developer Opera Software ASA)" <[e-mail]>]

Hello all,

Today Opera Software released a snapshot of Opera 10.50 alpha with support
for the TLS RenegotiationInfo extension.

Server vendors should note the following:

     * The RI extension is sent in all handshakes using extensions
     * The SCSV is only sent when we do not know if the server supports
extensions (implied: Patched servers always support the RI extension)
     * Against known patched servers Opera 10.50 will ONLY send Client  
Hellos
identifying TLS 1.2 as the highest supported version, and will abort  
ongoing
handshakes if it not already identifying with TLS 1.2. It will **NOT** fall
back to an older version if negotiation fails. Patched servers are assumed
to be version tolerant.
     * It is a fatal error for a server (identified by hostname and port) to
first indicate support for RI, then later (in the same session) fail to
indicate support.

Opera's implementation also contain an auto-updatable preference that can
(step 1) be used to get Opera installations to display certificate warning
dialogs for unpatched server, and (step 2) to disable support for unpatched
servers. If and when these updates will be used is currently undecided.

Additionally, a heads up: I've recently been doing some probing of TLS
servers and among a 100 000+ sample 40+% of the servers did not check the
RSA Premaster secret at all, and 0.7% required the wrong version (the
negotiated version) in this field. Another finding is that 60+% of the
tested servers did not tolerate the ClientHello.version field being set
to 4.1, which could cause problems if/when the major version number of
TLS is updated.

Further information and download links can be found at:

    <http://my.opera.com/desktopteam/blog/continued-stabilization >
    <http://my.opera.com/securitygroup/blog/2010/01/23/alpha-testing-tls-renego-fix  
>

-- 
Sincerely,
Yngve N. Pettersen

********************************************************************
Senior Developer                     Email: [e-mail]
Opera Software ASA                   http://www.opera.com/
Phone:  [phone]              Fax:    [phone]
********************************************************************