Re: [TLS] simplistic renego protection

[Eric Rescorla <[e-mail]>]

At Wed, 18 Nov 2009 15:36:42 +0100 (MET),
Martin Rex wrote:
> 
> Michael D'Errico wrote:
> > 
> > You forgot to mention:
> > 
> > 4.3.  SSLv3
> > 
> >     SSLv3 does not support extensions and thus it is not possible to
> >     securely renegotiate with SSLv3.  Deployments wishing to renegotiate
> >     securely will need to upgrade to at least TLS 1.0.
> > 
> > Is there some secret agenda to kill off SSLv3?  What is the point
> > of that?  SSLv3 accounts for more than one-in-five connections as
> > reported to this list.  There is an alternate proposal that does not
> > have this limitation, and is better in many other respects.  Why do
> > you keep pushing this one?
> 
> 
> This statement about SSLv3 actually reverts history.
> 
> The fact is, that SSLv3 has THE EXACT SAME provisions for
> TLS extensions as TLSv1.0.
> 
> But TLS extensions seems to exclude _itself_ from being used with SSLv3
> -- which looks like a pretty bad idea, given that the extensibility
> of TLSv1.0 and SSLv3 is verbatim the same.

Well, I'm not taking any responsibility for that. I didn't write
the original TLS extensions doc. That said, I suspect the feeling
was that the IETF didn't have any control of SSLv3, and so couldn't
mandate anything about it.

-Ekr