Re: [TLS] Analysis of Interop scenarios TLS extension RI w/MCSV

[Nelson B Bolyard <[e-mail]>]

On 2009-12-10 14:01 PST, Marsh Ray wrote:
> Martin Rex wrote:
>> Marsh Ray wrote:
>>> That is interesting information. Would you happen to have a copy of the
>>> last "official" spec you can send me?
>> Netscape's official SSLv3 spec as of 2005:
>> http://web.archive.org/web/20050207004652/wp.netscape.com/eng/ssl3/3-SPEC.HTM
> 
> Thanks.
> 
> That's pretty clear, SSLv3 did not have a provision for extending Client
> Hello.
> 
>> As obvious from it's name that spec is a product of the TLS WG and
>> the TLS WG decided to completely abandon (instead of publishing as
>> informational RFC) that document so that it expired and vanished
>> from the I-D repository 6 month later.
> 
> Seems like SSLv3 was simultaneously one of the most critical protocols
> for net security and orphaned.

Stop right there.  Don't be led down the garden path.

Look at the parent page.  Look at
http://web.archive.org/web/20050205162914/wp.netscape.com/eng/ssl3/

It clearly says that "The most recent Draft SSL 3.0 specification, an
Internet Draft dated November 1996, may be viewed here. It is an ASCII
document".  It is a link to http://wp.netscape.com/eng/ssl3/draft302.txt
which is draft-freier-ssl-version3-02.txt, now seen at
http://www.mozilla.org/projects/security/pki/nss/ssl/draft302.txt

That parent page also says:  "The previous draft of the SSL 3.0
Specification, dated March 1996, may be viewed in this HTML document."
which is a link to
http://web.archive.org/web/20050206124632/wp.netscape.com/eng/ssl3/ssl-toc.html
which in turn has a link to the page Martin cited above.

You'll find my name in some of those pages, too.  Don't let a non-Netscape
person tell you what was, and what was not "official" at Netscape.

Netscape never orphaned 3.0.  It kept the "most recent draft" alive for
the rest of its days, and is still kept alive today at Mozilla.org, which
runs NSS code which is a direct descendant of Netscape's original code.