Re: [TLS] assert TLSext in renego-ServerHello instead of disable

[Marsh Ray <[e-mail]>]

Martin Rex wrote:
> If you see the client's signal in the ClientHello that it is updated
> and no signal for the new behaviour in the ServerHello, then you can
> distinguish configured secure (Client closes network connection with
> or without sending a fatal alert) from configured insecure (handshake
> continues).

Good point. The info may be available without the need to be stated
explicitly. But only after an insecure handshake gets underway.

> If your idea is about being able to "check" client's configuration on
> _any_ TLS connection, that is not something that TLS is designed
> (or supposed) to provide.

We're dealing with something that's already outside of the original
design, so we can't afford to be too principled. These protocol bits
have to satisfy the installed base.

Is it all that different than sending GMT instead of random data?

- Marsh