Re: [TLS] Triple Handshake Fix.

["Yngve N. Pettersen" <[e-mail]>]

Hi,

On Tue, 29 Apr 2014 23:05:50 +0200, Adam Langley <[e-mail]> wrote:

> I think the change to the master secret calculation is relatively
> uncontroversial (and is probably what the master secret should always
> have been). People might have differing opinions on the SCSV, but that
> doesn't affect whether a TLS extension number will ultimately be
> allocated for it.
>
>
> [1] https://secure-resumption.com
> [2] https://secure-resumption.com/draft-bhargavan-tls-session-hash-00.txt

A comment about the draft:

Section 5.3 states:

    In its ClientHello message, a client MUST either send the
    "extended_master_secret" extension, or the
    "TLS_EXTENDED_MASTER_SECRET" SCSV.  Clients SHOULD NOT include both.

In my opinion, the "SHOULD NOT" ought to be a "MUST NOT", *unless* the  
document also states something like "Servers MUST accept ClientHello  
messages that contain both the "extended_master_secret" extension and the  
"TLS_EXTENDED_MASTER_SECRET" SCSV, and treat them as if only one had been  
received"

When I originally implemented the Renego Information extension in Opera, I  
decided to send both, since deciding when to send either complicates the  
code, at least a little. However, I had to eventually change the code to  
send only one of them (SCSV in extension less handshakes, extension  
otherwise), as 4.7% of Renego patched servers does not tolerate the  
combination, some of them major sites like Linkedin and Paypal.

A SHOULD NOT means that the server may encounter handshakes with both, and  
since server vendors apparently are apt to think that "either" and "SHOULD  
NOT include both" in combination means "MUST NOT include both", then the  
document should either specify how the server should handle reception of  
both indicators, or say that both are forbidden.

-- 
Sincerely,
Yngve N. Pettersen

Using Opera's mail client: http://www.opera.com/mail/