Re: [TLS] History of extensions

[Nicolas Williams <[e-mail]>]

On Sat, Nov 14, 2009 at 11:05:18AM +0200, Eric Rescorla wrote:
> At Sat, 14 Nov 2009 02:28:13 -0600,
> Nicolas Williams wrote:
> > 
> > On Sat, Nov 14, 2009 at 01:08:16AM +0200, Eric Rescorla wrote:
> > > At Fri, 13 Nov 2009 10:46:09 -0600,
> > > Nicolas Williams wrote:
> > > > The post with message-ID <[e-mail]>, subject
> > > > "Comments on draft-rescorla-tls-renegotiate", sent at 18:54:19 -0600
> > > > yesterday most certainly described no Hello extensions, only a Finished
> > > > message verify_data computation change.
> > > 
> > > Yes, and it doesn't allow you to probe in a compatible way.
> > 
> > No, that's not correct.  On initial connection there's no need to do
> > anything special (sure, it's nice to know that your peer doesn't have
> > this vuln, but you don't have to).
> 
> Well, I don't know what "have to" means. Some clients may have
> the policy of not connecting to servers that aren't upgraded.
> The existing proposal allows that. Yours does not.

Indeed, though I'm not too concerned by that.  For me that is a
trade-off to make w.r.t. complications raised by using extensions in the
first place (bear with me, please).

IIUC the arguments about SSLv3, there's an installed base of SSLv3 and
TLS 1.0-with-bugs that is more likely to get patched to fix this and
only this than to get upgraded t TLS 1.1+ or to have all their bugs
patched.  I'm not sure that that's true.  IF it is true, then we have to
consider the possibility of designing the fix so that it's easier to
patch those.

In any case, I think it's more important to behave correctly than to
also signal that intend to -- the former is required, the latter is a
bonus.

Nico
--