[TLS] What would be the point of removing signalling in TLS 1.3?

[David-Sarah Hopwood <[e-mail]>]

Stefan Santesson wrote:
> Consequently, if we design an updated Finished calculation now, we can keep
> that in TLS 1.3 and just remove the signaling we now add for SSLv3 -> TLS
> 1.2.

I really don't see any advantage in removing the signalling in TLS 1.3.
It doesn't simplify anything.

For removing the signalling to work, we would have to specify in the
*current* fix that:

 - sending a client version of {0x03, 0x04} or higher has the same
   meaning as sending the client->server signal.

 - negotiating {0x03, 0x04} or higher has the same meaning as sending
   the server->client signal.

That is just additional specification and implementation complexity, and
more cases that need to be tested, compared to using the signalling forever
and treating TLS 1.3+ in exactly the same way as TLS 1.0-1.2. Forget the
number of extra bits on the wire (which is negligable); it's the complexity
of the spec and of implementations, which necessarily have to support
multiple versions, that matters.

The original SSLv3 design messed up renegotiation; we'll just have to live
with some ugliness as a result of fixing it.

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com