MIME-Version: 1.0
In-Reply-To: <4152939.QfPvxGhp5y@pintsize.usersys.redhat.com>
References: <4152939.QfPvxGhp5y@pintsize.usersys.redhat.com>
From: Eric Rescorla <ekr@rtfm.com>
Date: Thu, 1 Sep 2016 09:19:46 -0700
Message-ID: <CABcZeBOG7go9Jseo9tT4zug=13=qpDfzYJ-DTW9ZmJnW50RT+g@mail.gmail.com>
To: Hubert Kario <hkario@redhat.com>
Content-Type: multipart/alternative; boundary=94eb2c0779ce7cc801053b74977d
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/NNVyRjFBwmQbumBB-fgC4oini20>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] TLSv1.2 connection renegotiation to TLSv1.3
Precedence: list

--94eb2c0779ce7cc801053b74977d
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

This should be prohibited. A PR for this would be welcome.

-Ekr


On Thu, Sep 1, 2016 at 9:07 AM, Hubert Kario <hkario@redhat.com> wrote:

> I didn't notice in the -15 draft anything explicitly prohibiting sending =
a
> TLSv1.3 Client Hello inside established TLSv1.x connection (where x < 3).
>
> Is this something that the protocol should allow? If yes,
> renegotiation_info
> extension status would probably need to be updated. If not, then I think
> the
> document should be a bit more explicit about it.
> --
> Regards,
> Hubert Kario
> Senior Quality Engineer, QE BaseOS Security team
> Web: www.cz.redhat.com
> Red Hat Czech s.r.o., Purky=C5=88ova 99/71, 612 45, Brno, Czech Republic
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>
>

--94eb2c0779ce7cc801053b74977d
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">This should be prohibited. A PR for this would be welcome.=
<div><br></div><div>-Ekr</div><div><br><div class=3D"gmail_extra"><br><div =
class=3D"gmail_quote">On Thu, Sep 1, 2016 at 9:07 AM, Hubert Kario <span di=
r=3D"ltr">&lt;<a href=3D"mailto:hkario@redhat.com" target=3D"_blank">hkario=
@redhat.com</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" styl=
e=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I didn&=
#39;t notice in the -15 draft anything explicitly prohibiting sending a<br>
TLSv1.3 Client Hello inside established TLSv1.x connection (where x &lt; 3)=
.<br>
<br>
Is this something that the protocol should allow? If yes, renegotiation_inf=
o<br>
extension status would probably need to be updated. If not, then I think th=
e<br>
document should be a bit more explicit about it.<br>
<span class=3D"HOEnZb"><font color=3D"#888888">--<br>
Regards,<br>
Hubert Kario<br>
Senior Quality Engineer, QE BaseOS Security team<br>
Web: <a href=3D"http://www.cz.redhat.com" rel=3D"noreferrer" target=3D"_bla=
nk">www.cz.redhat.com</a><br>
Red Hat Czech s.r.o., Purky=C5=88ova 99/71, 612 45, Brno, Czech Republic</f=
ont></span><br>______________________________<wbr>_________________<br>
TLS mailing list<br>
<a href=3D"mailto:TLS@ietf.org">TLS@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/tls" rel=3D"noreferrer" ta=
rget=3D"_blank">https://www.ietf.org/mailman/<wbr>listinfo/tls</a><br>
<br></blockquote></div><br></div></div></div>

--94eb2c0779ce7cc801053b74977d--