Re: [TLS] Version negotiation, take two

[Benjamin Kaduk <[e-mail]>]

On 09/14/2016 04:56 AM, Hubert Kario wrote:
> First, I don't think that the argument that the current version scheme doesn't 
> lend itself to future-proofing is correct. Just as with GREASE, browsers can 
> send much higher version than they really support if they do that on a time 
> limited basis.

David had previously convinced me that it doesn't actually work very
well, but I forget the reasoning he used to do so. :(

> Second, while the "joint" which handles new extensions IDs doesn't seem to be 
> rusting, it's not the case with lists in particular extensions. SNI being the 
> prime example where sending anything but a single host name value will most 
> likely lead to your client hello being either misinterpreted or rejected.
>

But people will ~always be sending multiple elements in the list in the
version-negotiation extension -- you can't just send TLS 1.3; you also
send 1.2 for the near future.  And if browsers are grease-ing from the
beginning, I don't really see this one rusting.

-Ben