Subject: [TLS] Support for TLS extensions

From: [email-masked]
Date: Fri, 13 Jul 2007 18:19:20 +0200

Hi,

does anybody on this list know, which servers and browser support
TLS extensions, especially max_fragment_size? 

OpenSSL does not support them in the current version 0.98 (but 
upcomming 0.99 may have it when it's released). And Firefox 
2.0.0.4 does not care about the record length, too. 

regards, Axel

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: [email-masked] (Peter Gutmann)
Date: Mon, 16 Jul 2007 15:55:21 +1200

[email-masked] writes:

>does anybody on this list know, which servers and browser support TLS
>extensions, especially max_fragment_size?

My code has support in there for it, but since I've never found anything else
that does it's currently commented out because I haven't been able to do any
interop testing.

(It's always interesting to look back on these desperately-needed facilities
that are added to standards to find that no-one is actually using them once
they're there :-).

Peter.

---

From: Rob Dugal <[email-masked]>
Date: Mon, 16 Jul 2007 06:39:28 -0400

We support the max_fragment_length extension in our SSL-C product. If you 
want to test interop I'll see if we can enable it on tls.secg.org 
The SSL-C product supports the following TLS extensions:
- max_fragment_length 
- client_certificate_url
- server_name indication
- Supported Elliptic Curves  (RFC 4492)
- Supported Point Formats  (RFC 4492) 
- SessionTicket (RFC 4507)

-----------------------------------------------
Robert Dugal
Member of Development Group
Certicom Corp.
EMAIL: [email-masked]
PHONE: (905) 501-3848
FAX  : (905) 507-4230
WEBSITE: www.certicom.com

---

From: [email-masked]
Date: Mon, 16 Jul 2007 12:50:48 +0200

Rob,

> We support the max_fragment_length extension in our SSL-C product. 
> If you want to test interop I'll see if we can enable it on 
> tls.secg.org 

If you could enable this, it would be very helpful for testing. 

---
Mit freundlichen Grüssen / Best regards

Axel Heider
NB4, Research and Development / Division New Business
Giesecke & Devrient GmbH, Prinzregentenstrasse 159, 81677 München, Germany
Tel.: +49-(0)89-4119-2693, E-Mail: axel.heider[at]gi-de.com , 
http://www.gi-de.com

Creating Confidence.
--------------------------------------------------------------

Vorsitzender des Aufsichtsrats: Dr. Peter Mihatsch
Geschäftsführer: Dr. Karsten Ottenberg (Vorsitzender, CEO),
Michael Kuemmerle, Hans Wolfgang Kunz,
Dr. Walter Schlebusch, Dr. Peter Zattler (CFO)
Gesellschaftssitz: München, Handelsregister Amtsgericht München HRB 4619.

---

From: [email-masked] (Peter Gutmann)
Date: Mon, 16 Jul 2007 23:20:18 +1200

>want to test interop I'll see if we can enable it on tls.secg.org

That'd be most useful, thanks.

(Since SECG is probably the reference location for things like the ECC suites,
would it be possible to set up a permanent server, not necessarily the main
secg.org one, that can be kept online and used in the future for new
implementations and for regresssion testing?).

Peter.

---

From: Rob Dugal <[email-masked]>
Date: Mon, 16 Jul 2007 08:02:33 -0400

There has been some recent discussion here about setting up another test 
server for that purpose.
I'm just not sure exactly when it will happen because of other 
committments, resources, etc. 
I can probably enable this extension on tls.secg.org in a day or two.

---

From: Dr Stephen Henson <[email-masked]>
Date: Mon, 16 Jul 2007 13:55:19 +0100

> implementations and for regresssion testing?).

On a similar subject if RFC4507 could be enabled (or if anyone knows a
public server or implementation supporting it) that would be great. I'd
like to perform some interop testing at some point.

Steve.
-- 
Dr Stephen N. Henson.
Core developer of the   OpenSSL project: http://www.openssl.org/
Freelance consultant see: http://www.drh-consultancy.co.uk/
Email: [email-masked], PGP key: via homepage.

---

From: Mike <[email-masked]>
Date: Mon, 16 Jul 2007 09:08:32 -0700

> that does it's currently commented out because I haven't been able to do any

You can test against https://www.mikestoolbox.net.  It supports the max
fragment size extension.  Not much to test, though, since the server
won't choke if it receives a packet that's larger than you specify.  It
won't send you a larger packet though.

It also supports the truncated HMAC extension if you're interested in
that.  And the server name extension so it will send back a different
certificate if you connect to https://www.mikestoolbox.org.

Mike

---

From: "Ravi Prasad" <[email-masked]>
Date: Tue, 17 Jul 2007 11:48:35 +0530

Hi,
Check this server
	http://www.gnu.org/software/gnutls/server.html
and the server link 
	https://test.gnutls.org:5556/

We tested using a local setup. (We didn't use the online server)

Hope this is use full.

Thanks and Regards
Ravi Prasad

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Friday, July 13, 2007 9:49 PM
To: [email-masked]
Subject: [TLS] Support for TLS extensions 

Hi,

regards, Axel

#########################################
THIS EMAIL MESSAGE IS FOR THE SOLE USE OF THE INTENDED RECIPIENT(S) AND MAY CONTAIN CONFIDENTIAL AND PRIVILEGED INFORMATION. ANY UNAUTHORIZED REVIEW, USE, DISCLOSURE OR DISTRIBUTION IS PROHIBITED.BEFORE OPENING ANY ATTACHMENTS PLEASE CHECK FOR VIRUSES AND DEFECTS.IF YOU ARE NOT THE INTENDED RECIPIENT, PLEASE NOTIFY US IMMEDIATELY BY REPLY E-MAIL AND DELETE THE ORIGINAL MESSAGE.
#########################################

---

From: "Dieter Bratko" <[email-masked]>
Date: Mon, 23 Jul 2007 19:10:12 +0200

Hello,

> On a similar subject if RFC4507 could be enabled
> (or if anyone knows a public server or implementation
> supporting it) that would be great.

The SessionTicket extension according to RFC4507 is
supported by our Java SSL/TLS toolkit; also the
max_fragment_length extension and all other standard
extensions specified by RFC 3546 (server_name,
client_certificate_url, trusted_ca_keys, truncated_hmac,
status_request) . Please see
 http://jce.iaik.tugraz.at/sic/products/communication_messaging_security/isasilkRegards,Dieter---------Dieter Bratko, SIC/IAIK - Graz University of TechnologyInffeldgasse 16a, 8010 Graz, Austria, http://jce.iaik.tugraz.at/----- Original Message -----From: Dr Stephen HensonTo: Peter GutmannCc: [email-masked] ; [email-masked] ; [email-masked]: Monday, July 16, 2007 2:55 PMSubject: Re: [TLS] Support for TLS extensionsPeter Gutmann wrote:> Rob Dugal <[email-masked]> writes:>>> We support the max_fragment_length extension in our SSL-C product. If you>> want to test interop I'll see if we can enable it on tls.secg.org>> That'd be most useful, thanks.>> (Since SECG is probably the reference location for things like the ECCsuites,> would it be possible to set up a permanent server, not necessarily themain> secg.org one, that can be kept online and used in the future for new> implementations and for regresssion testing?).>On a similar subject if RFC4507 could!
  be enabled (or if anyone knows apublic server or implementation supporting it) that would be great. I'dlike to perform some interop testing at some point.Steve.--Dr Stephen N. Henson.Core developer of the   OpenSSL project: http://www.openssl.org/Freelance consultant see: http://www.drh-consultancy.co.uk/Email: [email-masked], PGP key: via homepage._______________________________________________TLS mailing [email-masked]://www1.ietf.org/mailman/listinfo/tls

---

From: Dr Stephen Henson <[email-masked]>
Date: Mon, 23 Jul 2007 21:35:13 +0100

Dieter Bratko wrote:
> http://jce.iaik.tugraz.at/sic/products/communication_messaging_security/isasilk

Thank you for the pointer. The demo server at:

http://jce.iaik.tugraz.at/sic/products/communication_messaging_security/isasilk/demo

doesn't seem to be working at present.

Do any of your public SSL servers support RFC4507 or do you have a demo
server that could be used for interop testing?

I tested www.iaik.at but it didn't respond with any TLS extensions.

Steve.

---

From: "Dieter Bratko" <[email-masked]>
Date: Tue, 24 Jul 2007 10:47:40 +0200

Hello Steve,

> doesn't seem to be working at present.

Thanks for the note; we are setting up a new server,

> server that could be used for interop testing?

You may download the iSaSiLk toolkit; it contains batch and shell
scripts (cmd/extensions, sh/extensions) for running small demo servers
and clients that can be used for testing. The demo sources are included
and can be easily modified to changes the properties if required.

Regards,
Dieter

----- Original Message ----- 
From: Dr Stephen Henson
To: Dieter Bratko
Cc: [email-masked]
Sent: Monday, July 23, 2007 10:35 PM
Subject: Re: [TLS] Support for TLS extensions

Steve.