Re: [TLS] Black hole was Re: Analysis of Interop scenarios TLS

[<[e-mail]>]

Martin Rex wrote:
> tom.petch wrote:
> >
> > There is a solution.  We should require, as part of this patch,
> > that upgraded stacks treat a version number that is greater than
> > some specified value as also being a signal that the peer is
> > upgraded.  Then we will be able to drop the MCSV and/or RI as a
> > signal from the '3.7' ClientHello. But we do need to include this
> > now.
> 
> In theory, you are correct.
> 
> This would, however, require us to effectively standarize the secure
> TLS renegotiation for TLSv1.3 (or some specific TLS version in the
> future) ahead of time.

I don't think this is what Tom was proposing. I understood his
proposal to be something like

  if negotiated_version <= 1.2 then:
     if (CH has MSCV) or (CH has RI) or (CH.proposed_version>1.2):
         client_supports_secure_renegotiation = True
         include RI in ServerHello
     else:
         client_supports_secure_renegotiation = False
  else:
     # do what the future spec says -- we don't know yet 
   
Or in other words: including a version >1.2 in ClientHello would mean
the same thing as MSCV or empty RI _when_ the negotiated version is
<=1.2. (But we wouldn't have to specify the behavior for negotiated
version >=1.3 at this time.)

I agree with Tom that if we want to drop MCSV and RI from the
ClientHello some day, we would need to specify this behavior now.  But
today it would be just more code (and unused code) on the server + an
extra test case or two.... so there are both pros and cons.
(And at this time, I'm not going to take an opinion either way.)

Best regards,
Pasi
(not wearing any hats)