Re: [TLS] Analysis of Interop scenarios TLS extension RI w/MCSV

[Martin Rex <[e-mail]>]

Marsh Ray wrote:
> 
> I would like for the decisions we make today to allow the MCSV hack to
> be retired at some point in the future. MCSV represents extra complexity
> that we added as a concession for interoperability with obsolete and
> out-of-spec systems.

MCSV is a very plain and simple backwards interoperability option,
and it will, in fact, make implementations easier (less code),
less bits-on-the-wire and more robust.


There is not only the wire-protocol to consider, but also the semantics
that TLS implementations have been providing to applications in the
installed base.  When an application has been requesting SSLv3 from
its TLS implementation in the past, then it probably did not distinguish
it's motivation for doing so -- whether it's a desire to _not_ use
TLS extensions, whether it's a desire to not use a higher protocol
version in the ClientHello, or whether the application knows that
it is trying to connect to an extensions-intolerant server.

The fact is, that we have established a specific semantic and
level expectation for such a request from the application,
and it would be very unwise to lightheartedly change such behaviour
in the installed base of largely unknown usage scenarios.

Doing the negotiation about updated implementations with
MCSV + ServerHelloExtension only will have the least amount
of impact on semantics and expectations in the installed base,
while providing all the functionality we need to protect
unsuspecting communication peers.

-Martin