Re: [TLS] ServerHello layout in TLS 1.3

[Dave Garrett <[e-mail]>]

On Saturday, December 12, 2015 03:28:01 pm Eric Rescorla wrote:
> On Sat, Dec 12, 2015 at 4:08 AM, Hannes Mehnert <[e-mail]> wrote:
> > while implementing the TLS 1.3 draft, I came across the modified
> > ServerHello message - it does neither contain a SessionID nor a
> > CompressionMethod field.  This makes code which supports both TLS 1.3
> > and earlier versions more complicated*:  a client sending out a
> > ClientHello does not know which protocol version the server is willing
> > to talk.
> >
> > Thus, depending on the protocol version inside of the server hello, the
> > remainder of the packet needs to be parsed.
> >
> > I'm not sure whether it is worth to safe two bytes (empty SessionID and
> > NULL CompressionMethod) to introduce such an intrinsic dependency.
> >
> > Is there a reason behind this change, apart from cleanup?
> 
> I'm not aware of ay reason besides cleanup. I don't feel strongly
> about the current state.

Leaving cruft around increases risk of mistakes; if you leave in obsolete fields when they're not needed anymore, a dumb implementation might accidentally use it or be tricked into doing so by an attacker. That said, the world will not end if yet more kludgy placeholders are needed. I'd prefer to avoid that if at all possible, though.


Dave