Re: [TLS] Avoiding first use of RI in ClientHello

[<[e-mail]>]

Robert Relyea wrote:

> This is not an RI specific issue. TLS already defines a number of
> extensions. This fallback policy was implemented not because
> extension noncompliant servers were particularly important, but
> because implementations needed to have minimal objections for moving
> forward and actually using extensions. Today TLS clients regularly
> use extensions, so adding one more to allow renegotiation should not
> be an issue.

It probably isn't for clients that *already* use extensions.  The
major PC/Mac/Linux web browsers do, but those are not the only TLS
clients out there.

I can see that it could be a big issue for clients that today do not
send extensions. Not because extensions themselves are difficult to
implement, but as Eric pointed out, the fallback logic could be very
difficult to implement (and may require changing applications), and
most importantly, if you don't send extensions currently, you don't 
really know whether you need the fallback logic before you've broken 
things that work today...

Best regards,
Pasi
(not wearing any hats)