Re: [TLS] assert TLSext in renego-ServerHello instead of disable renego

[Dr Stephen Henson <[e-mail]>]

Yoav Nir wrote:
> Actually, there have been messages suggesting that clients sending this (or any other) extension, may have their session terminated, especially if using SSLv3 and even with some TLS 1.0 servers. If that is true for even a small minority of servers (say, 1%) we can't realistically expect browser vendors to add this, except buried deeply in some advanced menu.
> 
> I wish we had some hard data on this, but if this is true, we may need to find other ways for the client to signal support, or to signal re-negotiation.

After OpenSSL enabled TLS extensions by default it initially included them in
SSLv3 client hello's too. We did have quite a few reports of problems so this
was disabled in the latest snapshots. Anything using an SSLv3 compatible client
hello (i.e. says it supports TLSv1 or later but will also accept SSLv3) has the
same potential problem and the deprecated SSLv2 compatible client hello is of
course a non-starter.

Not sure if this has been mentioned before but a dummy ciphersuite should be
acceptable to any server. That is we allocate one unused ciphersuite to have the
special meaning of "client supports renegotiation extension". Those so inclined
could include it in an SSLv2 compatible client hello too.

How a server signals support then becomes a problem. You can't send back an
extension in the server hello without violating the protocol rules as they
currently stand.

Steve.
-- 
Dr Stephen N. Henson.
Core developer of the   OpenSSL project: http://www.openssl.org/
Freelance consultant see: http://www.drh-consultancy.co.uk/
Email: [e-mail], PGP key: via homepage.