Re: [TLS] ALPN concerns

[Yoav Nir <[e-mail]>]

On Nov 5, 2013, at 6:32 PM, Geoffrey Keating <[e-mail]> wrote:

> Martin Thomson <[e-mail]> writes:
> 
>> On 5 November 2013 14:21, Brian Smith <[e-mail]> wrote:
>>> I am
>>> very concerned about the issues that they've run into where many web
>>> servers are failing to handshake when the ClientHello message is
>>> larger than 255 bytes.
>> 
>> I can understand the need to avoid the ceiling in the short term, no
>> question.  But how much headroom is there?
>> 
>> Having some specific numbers would definitely help inform the
>> discussion.  Clearly, including SNI with a maximum-length hostname is
>> going to blow this limit, so the question is where we think the line
>> needs to be drawn.
> 
> To give an idea:
> 
> A TLS 1.2 ClientHello which lists all the authenticated ciphersuites
> currently defined (no anonymous), EC curves and formats, and signature
> algorithms, but no SNI, is 528 bytes.  So you can already be way over
> 255 bytes just with things already defined.
> 
> The TLS 1.2 Safari ClientHello in OS X 10.9 when connecting to
> ssl.apple.com is 180 bytes, and that has SNI but no NPN or similar,
> and a limited number of elliptic curves.
> 
> I think the Safari ClientHello is close to the minimum you would want;
> that is, if your ClientHello is much shorter, you're probably missing
> something more important than ALPN.  I would suggest allowing 30 bytes
> for longer domain names.  So there's maybe 45 bytes to split between
> ALPN, TLS 1.4, AEAD ciphers, new elliptic curves, and any other
> feature that might be implemented in future.

Don't forget 32 bytes for session ID or any number of bytes for session ticket in resumption attempts. Now your 45 bytes are down to 13 or less.  

And as for domain names:
http://www.thelongestdomainnameintheworldandthensomeandthensomemoreandmore.com