Re: [TLS] TLSrenego - possibilities, suggestion for SSLv3

[Marsh Ray <[e-mail]>]

Joseph Salowey (jsalowey) wrote:
>  
> [Joe] The server is not allowed to send an extension if the client does
> not send it.  I don't see a spec problem here.  

I certainly see the logic in that. This is a very interesting point.

The SSLv3 spec says Client Hello can contain extra data. In theory, we
should be able to add client hello extensions and servers which don't
interpret them will ignore them. Servers which do interpret them may
respond with a Server Hello extension which is undefined by this spec,
but that's OK because it doesn't happen unless the client asked for it.

But there was no structure defined for that extra data and there were no
major implementations to put anything there. Even if a client did want
to use it, there was no type-length-value layout defined for it, so
there was no way to send more than one extension. This effectively shut
off that facility for experimental or vendor-specific use. The only
party who could safely put any data there was the IETF, and that didn't
seem to happen until RFC 3546 TLS Extensions (June 2003), which defined
five specific extensions (and only for TLS 1.0 not SSLv3).

Until then, there was no client implementation that sent extensions, and
it was not possible for implementors to add their own in an
interoperable way. Probably new development on SSLv3 had all but stopped
by then. This effectively meant that server implementations were not
tested to ignore extensions (or process them) until quite recently.

So in practice, in order for a protocol structure to be usable in the
future there has to have been some way to develop and test against it
from the beginning.

- Marsh