Re: [TLS] History of extensions

[Martin Rex <[e-mail]>]

Eric Rescorla wrote:
> > 
> > IIUC the arguments about SSLv3, there's an installed base of SSLv3 and
> > TLS 1.0-with-bugs that is more likely to get patched to fix this and
> > only this than to get upgraded t TLS 1.1+ or to have all their bugs
> > patched.  I'm not sure that that's true.  IF it is true, then we have to
> > consider the possibility of designing the fix so that it's easier to
> > patch those.
> 
> As I said, clients offer extensions already and know how to fall
> back to not using extensions. I don't see that there is a problem
> here.

I think you're mistaken.

The common Web Browsers may have such a fallback, but there are
much more users of TLS than just Web Browsers.  The majority of
programmatic clients don't use such a fallback.  Remember, that
this fallback is entirely an apps thingy -- you can not put it
into TLS itself.  So you will need to patch every app using
TLS to add a reconnect fallback in order to be able to use
TLS extension RI and not loose connectivity.

The reconnect fallback is a performance problem by itself,
and requires a significant of code added to the app.

I'm sorry, but I don't like this idea at all.

If the problem was so severe that all Browsers added the reconnect
fallback, that it is possibly to big to ignore it now.


-Martin