Re: [TLS] A la carte handshake negotiation

[Nico Williams <[e-mail]>]

On Mon, Jun 29, 2015 at 12:06:04PM +0300, Ilari Liusvaara wrote:
> On Mon, Jun 29, 2015 at 08:58:11AM +0000, Peter Gutmann wrote:
> > Nico Williams <[e-mail]> writes:
> > >On Sun, Jun 28, 2015 at 10:44:03AM +0300, Ilari Liusvaara wrote:
> > >
> > >>"Chinese menus" with coupled choices are classical source of interop
> > >>problems.
> > >
> > >It's worked for SSHv2.
> > 
> > It worked for SSH because implementations use algorithm groups in highly
> > stereotyped ways, so you have a de facto interop profile. Try negotiating
> > e.g. RC4+SHA in one direction and AES+SHA2 in the other and see how quickly
> > the wheels fall off.
> 
> Also, regarding kex+auth in SSH2, the authentication is interactive, so
> choosing something bad most likely just gives an error and client trying
> something else. Definitely not the case in TLS.

Not so.  _User_ authentication in SSHv2 is retriable, but the key
exchange part of the protocol (which includes server authentication) is
not.

> And record protections in different directions aren't even coupled choice
> (all pairs should technically work).

Again, that was a mistake that nobody takes advantage of.  I don't
understand how it came to be.