Re: [TLS] A new consensus call on ALPN vs NPN (was ALPN concerns)

[Yoav Nir <[e-mail]>]

On Dec 11, 2013, at 11:50 PM, Daniel Kahn Gillmor <[e-mail]> wrote:

> On 12/11/2013 10:16 AM, Yoav Nir wrote:
>> I think it's possible to get all the extension hiding we want in TLS 1.3, even while keeping BC with TLS 1.0 servers:
>> 
>> 1. Client sends ClientHello without the problem extensions (ALPN, SNI). The record version is 3.1 (TLS 1.0), while the supported version is 3.4 (TLS 1.3). 
>> 
>> 2a. The server replies with TLS 1.3, and everything works as planned. The end.
>> 
>> 2b. The server replies with TLS 1.0, and some certificate. The certificate may or may not fit the site. Makes no difference for now.
>> 3b. The client completes the exchange, and immediately begins a renegotiation
>> 4b. In this renegotiation, the versions offered are just TLS 1.0 to TLS 1.2, and all extensions are present (though encrypted).
>> 5b. The renegotiation completes at TLS 1.0 with all extensions.
> 
> This approach should work to hide all extensions in current versions of
> TLS as well, right?  But no one does it, as far as i know.

Not that I'm aware of either, but it's not that different from hiding client certificates by making the first handshake server-authenticated, and the second handshake mutually-authenticated. That is something that some servers do, and all the clients cooperate nicely.

> Do you know of any TLS client library which does this, or provides an
> option to do it without a bunch of manual intervention in the workflow
> of the TLS stack by the library user?  Do you think certain tools or
> users should be doing this now?

I've seen the client certificate hiding done with Apache and OpenSSL. I don't think any information in the TLS handshake is as sensitive as the user name in the certificate.

> 
> Are there any extensions which require that their content must be
> identical across session resumption or across a re-handshake?

Not to my knowledge.

> If so, it doesn't seem like those extensions could be used in this
> re-handshake approach.
> 
> 
> 	--dkg
> 
>