Re: [TLS] Short notes on TLS RFCs ...

[Robert Ransom <[e-mail]>]

On 6/20/14, Michael Tuexen <[e-mail]> wrote:
> On 20 Jun 2014, at 14:31, Watson Ladd <[e-mail]> wrote:
>
>> On Fri, Jun 20, 2014 at 9:15 AM, Michael Tuexen
>> <[e-mail]> wrote:
>>> On 20 Jun 2014, at 05:32, Colm MacCárthaigh <[e-mail]> wrote:
>>>
>>>>
>>>> 3. The purpose of heartbeat message seems to be a form of path MTU
>>>> discovery, but they also seem ill-suited to MTU discovery. In
>>>> particular, Heartbeat messages seem to me capable of only discovering
>>>> the lowest-MTU supported in both directions of transmission; rather
>>>> than the actual MTU of the network paths; which can be (and sometimes
>>>> are) asymmetrical.  This may seem very esoteric, but as WANs and
>>>> transit providers deploy jumbo-frames inconsistently, asymmetrical
>>>> MTUs are becoming more common. Though hopefully that day will pass.
>>> No, heartbeat messages contain a payload being reflected and a padding
>>> being discarded. Therefore you can send your (large) probe packet
>>> containing a relatively small payload and a padding to get it to
>>> the size you want to test, and just get back a small answer containing
>>> the payload (and a small padding). So the padding is there especially
>>> for dealing with asymmetric paths.
>>
>> So Heartbleed is a feature: send a small packet and get a large
>> response for the direction you want to test.
> No... You send a large packet (mostly containing padding) and get
> back a small one (mostly containing the reflected payload)...

‘Heartbleed’ allowed a party to send a small packet and receive a large reply.


Robert Ransom