Re: [TLS] History of extensions

[Nicolas Williams <[e-mail]>]

On Thu, Nov 12, 2009 at 09:36:09PM +0100, Martin Rex wrote:
> Backwards signaling server->client that the server is updated is
> a little more difficult because one would have to repurpose an element
> of the ServerHello.  If there really are SSL implemenations that fill
> the unix_gmt_time with all random data (instead of just fuzzing the
> lower bits of it), then that part requires a less "pure" approach.
> 
> Maybe by confiscating a currently unused bit of the more tightly
> controlled value ranges of other members of the ServerHello handshake
> message (server_version.major, cipher_suite or compression_method).

The whole point of my post was to point out that there is a way to do
the server->client signaling without changing a single bit on the wire
-- just the Finished message computations.

Interestingly, that approach could even be used on initial connections
to detect if the server will support secure re-negotiation _before_ the
client ever tries it.

> ...but actually, we wanted to Last Call Eric's proposal, didn't we? 

Yes.  That's why I wrote "[i]f [my alternative proposal] means improved
odds for interop, then you should consider it".

If we have consensus that EKR's fix is sufficient, then we should just
move forward with it.

(I've not followed all of the SSLv3 sub-threads, so I'm not sure if my
proposal would help w.r.t. SSLv3.  I leave that to you to figure out.)

Nico
--