Re: [TLS] Verify data in the RI extension?

[Martin Rex <[e-mail]>]

Eric Rescorla wrote:
> 
> > It should _not_ be a question how beautiful the solution is and how well it
> > fits into new implementations, but primarily, that it fits equally
> > well even the oldest implementations around, and that it is easy
> > for them to implement, otherwise we are not going to see the
> > widespread adoption that we need.
> 
> I'm not sure I buy this: the vast majority of TLS implementations run
> one of a small number of stacks (SChannel, OpenSSL, NSS).

You're only looking at WebServers and WebBrowsers.
Maybe because Statistics like Netcraft have such a limited perception.

Btw. these "small number of stacks" is in reality a larger number
of independently maintained codelines.  Schannel may be ~30,
OpenSSL is probably >> 500, and most of them are quite old.

There are probably several independent SSL implementations for Java.


-Martin