Re: [TLS] Renego Indication RI patch interaction with TLS major version interop

["Brian Smith" <[e-mail]>]

Marsh Ray wrote:
> Article from Yngve:
> http://my.opera.com/yngve/blog/2010/06/02/renego-patched-servers-a-long-
> term-interoperability-time-bomb-brewing
> 
> http://www.links.org/?p=943
> 
> I haven't finished reading the full article yet, but I thought others
would be
> interested:
> > In the past few weeks, as many as 80-90% of the newly patched servers
> > have refused to negotiate with our tester (the TLS Prober) when it
> > claimed to support the hypothetical v4.1 TLS protocol version (or, as
> > I call it, "TLS NG"). This is much higher than the 69% of all servers
> > that generally exhibit the same problem.

NSS has an explicit check that the first byte of every version number is
0x03. I imagine other implementations have a similar check. Version handling
in NSS will be revamped sometime before TLS 1.1 and TLS 1.2 support are
added to it, and  the patches for that work already remove the check for
0x03.

His test would probably be much more successful if he used 0x03FF as the
version number. I don't think it is a big deal; the main consequence is that
all TLS version numbers should continue to start with 0x03. 

Regards,
Brian