Re: [TLS] Short notes on TLS RFCs ...

On 20 Jun 2014, at 14:31, Watson Ladd <watsonbladd@gmail.com> wrote:

> On Fri, Jun 20, 2014 at 9:15 AM, Michael Tuexen
> <Michael.Tuexen@lurchi.franken.de> wrote:
>> On 20 Jun 2014, at 05:32, Colm MacCárthaigh <colm@allcosts.net> wrote:
>> 
>>> 
>>> 3. The purpose of heartbeat message seems to be a form of path MTU
>>> discovery, but they also seem ill-suited to MTU discovery. In
>>> particular, Heartbeat messages seem to me capable of only discovering
>>> the lowest-MTU supported in both directions of transmission; rather
>>> than the actual MTU of the network paths; which can be (and sometimes
>>> are) asymmetrical.  This may seem very esoteric, but as WANs and
>>> transit providers deploy jumbo-frames inconsistently, asymmetrical
>>> MTUs are becoming more common. Though hopefully that day will pass.
>> No, heartbeat messages contain a payload being reflected and a padding
>> being discarded. Therefore you can send your (large) probe packet
>> containing a relatively small payload and a padding to get it to
>> the size you want to test, and just get back a small answer containing
>> the payload (and a small padding). So the padding is there especially
>> for dealing with asymmetric paths.
> 
> So Heartbleed is a feature: send a small packet and get a large
> response for the direction you want to test.
No... You send a large packet (mostly containing padding) and get
back a small one (mostly containing the reflected payload)...

Best regards
Michael
> 
> Sincerely,
> Watson Ladd
>> 
>> Best regards
>> Michael
>>> 
>>> Again, apologies if my notes are duplicative, but figured it was
>>> better to report a dupe than to miss something.
>>> 
>>> --
>>> Colm
>>> 
>>> _______________________________________________
>>> TLS mailing list
>>> TLS@ietf.org
>>> https://www.ietf.org/mailman/listinfo/tls
>>> 
>> 
>> _______________________________________________
>> TLS mailing list
>> TLS@ietf.org
>> https://www.ietf.org/mailman/listinfo/tls
> 
> 
> 
> -- 
> "Those who would give up Essential Liberty to purchase a little
> Temporary Safety deserve neither  Liberty nor Safety."
> -- Benjamin Franklin
> 