Re: [TLS] Next Protocol Negotiation 03

[Adam Langley <[e-mail]>]

On Wed, Nov 14, 2012 at 3:31 PM, Andrei Popov
<[e-mail]> wrote:
> A number of issues have been raised with regard to the TLS NPN Internet-Draft, including the downgrade attack described by Marsh. Is an updated draft in the works?

I've nothing to add to -04 at the moment.

I'm afraid you'll have to highlight the attack that you're referring
to. Since the messages are covered by the Finished hash, there's no
downgrade attack that doesn't also work against anything else in the
handshake.

The major point of contention that I'm aware of is the addition of
encrypted extensions, rather than just negotiating in the client and
server hello messages, in the clear.

This is clearly additional complexity and the benefit is limited by
the fact that the server still advertises in the clear. It's the best
that can be done without adding additional round trips.

On the complexity side, there haven't been any significant issues with
implementations of the similar version of NPN that's currently used by
SPDY, except in the case of one hardware accelerator product who had
issues. They, however, appear to have figured it out.

On the benefits side, although having the server advertise in the
clear is unfortunate, that's only needed for supporting client
fallback. If the client knows what protocol it supports, it can simply
choose it and that choice is protected. Since we're in this position
partly because TCP port numbers have become unusable, it seems to be
the height of folly to create another cleartext selector and expect a
different result.

So those reasons, I believe that the current NPN design is the correct one.


Cheers

AGL