Re: [TLS] ALPN concerns

[Geoffrey Keating <[e-mail]>]

Martin Thomson <[e-mail]> writes:

> On 5 November 2013 14:21, Brian Smith <[e-mail]> wrote:
> > I am
> > very concerned about the issues that they've run into where many web
> > servers are failing to handshake when the ClientHello message is
> > larger than 255 bytes.
> 
> I can understand the need to avoid the ceiling in the short term, no
> question.  But how much headroom is there?
> 
> Having some specific numbers would definitely help inform the
> discussion.  Clearly, including SNI with a maximum-length hostname is
> going to blow this limit, so the question is where we think the line
> needs to be drawn.

To give an idea:

A TLS 1.2 ClientHello which lists all the authenticated ciphersuites
currently defined (no anonymous), EC curves and formats, and signature
algorithms, but no SNI, is 528 bytes.  So you can already be way over
255 bytes just with things already defined.

The TLS 1.2 Safari ClientHello in OS X 10.9 when connecting to
ssl.apple.com is 180 bytes, and that has SNI but no NPN or similar,
and a limited number of elliptic curves.

I think the Safari ClientHello is close to the minimum you would want;
that is, if your ClientHello is much shorter, you're probably missing
something more important than ALPN.  I would suggest allowing 30 bytes
for longer domain names.  So there's maybe 45 bytes to split between
ALPN, TLS 1.4, AEAD ciphers, new elliptic curves, and any other
feature that might be implemented in future.