Re: [TLS] Renego Indication RI patch interaction with TLS major

["Yngve N. Pettersen (Developer Opera Software ASA)" <[e-mail]>]

On Wed, 16 Jun 2010 02:37:00 +0200, Martin Rex <[e-mail]> wrote:

> Yngve N. Pettersen wrote:
>>
>> For those interested, at present
>>
>>    - 3.4% of 383531 probed servers are intolerant in the 3.x range (69%
>> including the 4.x range, 83% of renego patched server also in the v4.x
>> range)
>
> Which means that the few renego patched implementations that have
> been installed are those that are intolerant to protocol version v4.x

No, the number was above 60% before renego patching started (the renego  
patched servers are 13% of the total)

>>
>>    - 0.4% require RSA CKE version field to match negotiated version
>>    - 31.6% does not check the RSA CKE version field
>
> There had been defective clients sending incorrect RSA CKE versions,
> and a change from non-checking to checking the value in a server
> implementation would suddenly break interop with those (old) clients.

As you can see, ~68% of servers seem to have no problem checking it.

> Checking of the RSA CKE version field is only for the situation that
> your server (a) allows extremely weak cipher suites and the client
> offers nothing but extremely weak cipher suites.

It is also for the case in which a weakness is discovered in an old  
version that enable an attacker to perform a version rollback attack.

Although, considering that this check is only performed in RSA, not DH  
type key exhange, one can wonder if it is at all needed.

>>    - 43 of 383531 servers mirror the client hello version back to the  
>> client
>>    - 990 of 383531 server use the record protocol field instead of the
>> client hello version when negotiating
>
> I assume that by "client hello version" you are actually refering
> to the "client_version" field of the ClientHello handshake message?

Yes,

>>    - 99 of 383531 support TLS 1.1
>>    - 2 of 383531 support TLS 1.2 (both are known test servers)
>
> That's even less than what I would have expected.
>
> How many of these 383531 servers are still at SSLv3?

1.6% (~6000), but renego patched are actually at about 0.4%, so many are  
upgrading.


>>
>> None of these six servers tolerate v3.4, "TLS 1.3" (multiple tests
>> performed), TLS 1.2 was accepted.
>
>
> There is no such thing as TLS 1.3 and given the adoption rate of

No there is not, but the specification is clear on this point: The server  
MUST send its highest supported version whenever the client indicates a  
higher version than it supports.


> TLSv1.1 and TLSv1.2, the message from implementors seems clear:
> fancy features for which there is no pressing need for a significant
> fraction of the installed base should be implemented and negotiated
> through a TLS extension rather than a new TLS protocol revision.

Which would lead to a mess of extensions after a while for things that can  
be better indicated in a version field.


-- 
Sincerely,
Yngve N. Pettersen

********************************************************************
Senior Developer                     Email: [e-mail]
Opera Software ASA                   http://www.opera.com/
Phone:  [phone]              Fax:    [phone]
********************************************************************