Re: [TLS] Analysis of Interop scenarios TLS extension RI w/MCSV

[Martin Rex <[e-mail]>]

Marsh Ray wrote:
> 
> David-Sarah Hopwood wrote:
> > 
> > Why? What is the point of allowing the client to send an empty extension,
> > when a patched client MUST send the MSCV, and a patched server MUST use
> > *only* the MSCV to determine whether the client is patched? You'd just be
> > adding the option to send an extension that has no defined meaning.
> 
> I would like for the decisions we make today to allow the MCSV hack to
> be retired at some point in the future. MCSV represents extra complexity
> that we added as a concession for interoperability with obsolete and
> out-of-spec systems.  We all have to make compromises in life and
> protocol design, but it is better to do it in such a way that they
> eventually pass into history rather than build up over time.
> 
> Today there are many clients which never interoperate with
> extensions-intolerant servers. If at all possible, these should have the
> option of not sending the MCSV hack from the beginning.

Today there are many car owners that are not involved in car accidents,
we should get rid of liability insurances for cars.

The problem with this reasoning is, that you only know _after_ the
fact whether you needed it or not.

You're actually suggesting that Browser vendors split their codebase
in two (one with backwards interop and one without) for the gigantic
gain of saving 10 LoC in one of the then two different lines of code?


When browser vendors emphasize they know exactly when the last pre-trusted
RootCA cert they're shipping is dropped from their distribution, then
they boldly assume this is the time when no-one needs MD5-support anymore,
completely ignoring the much higher numbers of non-commercial CAs that a
lot of companies are using, self-signed certs, certs installed on
devices and more.  MD5 may be bad, but it is still better than nothing.

Removing vital functionality in a knee-jerk reaction just because
some implementer sees no more use for it in his personal environment
might not be a very good idea.

OK, if you're working for a software vendor and are looking for an
extremely extended Xmas vacation, this might be an option to make
it happen...

-Martin