Re: [TLS] A new consensus call on ALPN vs NPN (was ALPN concerns)

[Daniel Kahn Gillmor <[e-mail]>]

On 12/11/2013 10:16 AM, Yoav Nir wrote:
> I think it's possible to get all the extension hiding we want in TLS 1.3, even while keeping BC with TLS 1.0 servers:
> 
> 1. Client sends ClientHello without the problem extensions (ALPN, SNI). The record version is 3.1 (TLS 1.0), while the supported version is 3.4 (TLS 1.3). 
> 
> 2a. The server replies with TLS 1.3, and everything works as planned. The end.
> 
> 2b. The server replies with TLS 1.0, and some certificate. The certificate may or may not fit the site. Makes no difference for now.
> 3b. The client completes the exchange, and immediately begins a renegotiation
> 4b. In this renegotiation, the versions offered are just TLS 1.0 to TLS 1.2, and all extensions are present (though encrypted).
> 5b. The renegotiation completes at TLS 1.0 with all extensions.

This approach should work to hide all extensions in current versions of
TLS as well, right?  But no one does it, as far as i know.

Do you know of any TLS client library which does this, or provides an
option to do it without a bunch of manual intervention in the workflow
of the TLS stack by the library user?  Do you think certain tools or
users should be doing this now?

Are there any extensions which require that their content must be
identical across session resumption or across a re-handshake?

If so, it doesn't seem like those extensions could be used in this
re-handshake approach.


	--dkg