Re: [TLS] Renego Indication RI patch interaction with TLS major

[Martin Rex <[e-mail]>]

Yngve N. Pettersen wrote:
> 
> For those interested, at present
> 
>    - 3.4% of 383531 probed servers are intolerant in the 3.x range (69%  
> including the 4.x range, 83% of renego patched server also in the v4.x  
> range)

Which means that the few renego patched implementations that have
been installed are those that are intolerant to protocol version v4.x

>
>    - 0.4% require RSA CKE version field to match negotiated version
>    - 31.6% does not check the RSA CKE version field

There had been defective clients sending incorrect RSA CKE versions,
and a change from non-checking to checking the value in a server
implementation would suddenly break interop with those (old) clients.

Checking of the RSA CKE version field is only for the situation that
your server (a) allows extremely weak cipher suites and the client
offers nothing but extremely weak cipher suites.


>
>    - 43 of 383531 servers mirror the client hello version back to the client
>    - 990 of 383531 server use the record protocol field instead of the  
> client hello version when negotiating

I assume that by "client hello version" you are actually refering
to the "client_version" field of the ClientHello handshake message?


>
>    - 99 of 383531 support TLS 1.1
>    - 2 of 383531 support TLS 1.2 (both are known test servers)

That's even less than what I would have expected.

How many of these 383531 servers are still at SSLv3?


> 
> None of these six servers tolerate v3.4, "TLS 1.3" (multiple tests  
> performed), TLS 1.2 was accepted.


There is no such thing as TLS 1.3 and given the adoption rate of
TLSv1.1 and TLSv1.2, the message from implementors seems clear:
fancy features for which there is no pressing need for a significant
fraction of the installed base should be implemented and negotiated
through a TLS extension rather than a new TLS protocol revision.

Looking at the GOST cipher suites for TLS, implementations are doing
the TLSv1.2-style replacement of the PRF while still running at TLSv1.0,
and it works (and is MUCH less work than having to implement full
TLSv1.1 and v1.2 first).


-Martin