Re: [TLS] Analysis of Interop scenarios TLS extension RI w/MCSV

David-Sarah Hopwood <david-sarah@jacaranda.org> wrote:

> Martin Rex wrote:
> > Michael Gray wrote:
> >>> in order to reliably provide this,
> >>>
> >>>   - MCSV is defined to represent an empty TLS extension RI
> >>>
> >>>   - MSCV MUST be included in *ALL* initial ClientHello handshakes
> >>>     messages _plus_ all renegotiation ClientHellos in backwards
> >>>     interop scenarios (independent of full handshake or session
resume).
> >>>
> >>>   - empty TLS extension RI MUST NOT be sent, ever!
> >>
> >> This looks good to me, the only thing I would change is I think MUST
NOT
> >> would be better as SHOULD NOT as the later requires that the
implementer
> >> examine the conditions and implications etc to make the best decision.
> >
> > You are right.  I'm sorry.  I got a little carried away.
> >
> > A SHOULD NOT for sending _empty_ TLS extension RI is more appropriate.
>
> Why? What is the point of allowing the client to send an empty extension,
> when a patched client MUST send the MSCV, and a patched server MUST use
> *only* the MSCV to determine whether the client is patched? You'd just be
> adding the option to send an extension that has no defined meaning.
>

This shows how hard it is to harmonize the two proposed specs.  What I want
to avoid is a change to the on the wire protocol being used in production
environments due to applying this fix.

I see two use cases here;

A. Existing implementations that send extensions today and are therefore
are fine to add this additional extension.  Note: this means they are
already sending extensions, not just extension capable.  By applying this
fix nothing changes with the protocol being used.

B. Existing implementations that do not send any extensions today and as
such they must not change the protocol due to this fix, which means they
can only safely use the MCSV as the signaling method.

It seems to me that we simply need the appropriate wording to allow
implementers to decide the best strategy that needs to adopted based on
risk factors to deployed production environments rather than mandate A
which will break some production environments or mandate B which means that
extension using systems must use the CipherSuite method.

Naturally requiring only one signaling method is simpler and preferable
from an implementation and testing point of view.

- Mick

> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls