Re: [TLS] Non-extension solutions (requirements)

[Eric Rescorla <[e-mail]>]

At Sun, 15 Nov 2009 14:56:01 -0600,
Marsh Ray wrote:
> >> === R9. Must interoperate perfectly with unpatched systems.
> > 
> > Again, what does that mean?
> > Does it mean that a patched client connects without hesitation to an
> > unpatched and vulnerable server, thereby falling victim to the attack?
> 
> It means that whatever fix we propose on to the public has to work
> seamlessly. My guess is that we have one shot at delivering something in
> a window that ends quite soon. If the patch makes a first impression at
> breaking one in ten connections, most admins will simply choose the
> patch which disables all renegotiation. Once that happens, it's gone for
> good, yet a lot of important systems depend on it.

I'm confused: is anyone proposing a patch on the server which would 
break *any* connections? The only breakage I can see is that some
clients will be unable to operate with old servers. This doesn't
seem to have the effect you suggest at all.

-Ekr