Re: [TLS] Large extensions in the ClientHello

[Martin Rex <[e-mail]>]

Adam Langley wrote:
> 
> On Tue, Sep 13, 2011 at 11:00 AM, Florian Weimer <[e-mail]> wrote:
> > I need to fit up to 2**24-1 bytes into a ClientHello extension.  If I
> > read the protocol language correctly, the limit is 2**16-1, for all
> > extensions, and there is no way around that without major protocol
> > changes. Is this correct?
> 
> That's correct. At best I think you could use a small extension to
> negotiate and then have the client send it's jumbo handshake message
> as a new handshake type.
> 
> (Although keep in mind that some TLS implementations will reject
> handshake messages are are split over multiple records, although
> hopefully any that negotiate your extension will have sorted that
> out.)

A ClientHello extension of size 2**24-1 = 16 MBytes ?

There are likely numerous more pleasurable ways to commit suicide
than doing this.

Really, what is it that you're trying to accomplish?

There are so many problems that something like this will cause,
that it is likely better to use a totally different solution
(_not_ within the TLS handshake).

A large ClientHello is terrible for TCP congenstion control
(TCP slow start), the data is unavoidably in the clear,
the data not even integrity protected until after successful
completion of the TLS handshake, so the TLS stack has to
keep it around over a network round trip (once as TLS extension
data, and maybe a second time as a "cached handshake message"
in order to compute a handshake message hash with any possible
hash algorithm later during the TLS handshake.


-Martin