Re: [TLS] assert TLSext in renego-ServerHello instead of disable renego

[Nelson B Bolyard <[e-mail]>]

On 2009-11-13 13:37 PDT, Yoav Nir wrote:
> Actually, there have been messages suggesting that clients sending this 
> (or any other) extension, may have their session terminated, especially 
> if using SSLv3 and even with some TLS 1.0 servers.

That is true.  There definitely is some small fraction of SSL/TLS servers
out there that will not complete a handshake if the client hello has any
extensions whatsoever.

> If that is true for even a small minority of servers (say, 1%) we can't
> realistically expect browser vendors to add this, except buried deeply in
> some advanced menu.

By that logic, you might assume that browsers would not use extensions at
all today, "except buried deeply in some advanced menu", but that is not
the case at all.  Browsers DO use extensions when attempting to negotiate
TLS today, but not when attempting to negotiate SSL 3.0 (only).  Some
browsers have a "fall back" strategy that lets them try SSL 3.0 after a
TLS handshake attempt fails.  Whether that strategy will remain viable
going forward remains to be seen.  But don't expect use of TLS hello
extensions to stop because of it.

> I wish we had some hard data on this, but if this is true, we may need
> to find other ways for the client to signal support, or to signal 
> re-negotiation.

There is no objection among browsers to using this extension.

/Nelson Bolyard
Developer of TLS library used by Firefox