Re: [TLS] ALPN concerns

[Martin Thomson <[e-mail]>]

On 5 November 2013 14:21, Brian Smith <[e-mail]> wrote:
> I am
> very concerned about the issues that they've run into where many web
> servers are failing to handshake when the ClientHello message is
> larger than 255 bytes.

I can understand the need to avoid the ceiling in the short term, no
question.  But how much headroom is there?

Having some specific numbers would definitely help inform the
discussion.  Clearly, including SNI with a maximum-length hostname is
going to blow this limit, so the question is where we think the line
needs to be drawn.

Given information on sizes, there are other options available to us.
Changing to shorter ALPN strings, or even moving to binary identifiers
(which would be unpleasant, but probably manageable) are definitely
still possible.  And those are only the solutions that are constrained
to ALPN, if you are willing to look elsewhere, you might instead
suppress SNI instead for long hostnames.  After all,
http://www.abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijk.com/
created this problem for themselves.

If we're that close to the limit, then a great many of the advantages
of TLS1.3 are likely to be eliminated.  Most of the 0-RTT modes won't
work.