Subject: Re: [TLS] Avoiding first use of RI in ClientHello

From: Min Huang <[email-masked]>
Date: Thu, 26 Nov 2009 10:44:30 +0800

At Wed, 25 Nov 2009 16:05:53 -0800
Eric Rescorla wrote:
 
...
 
>> The whole idea that extensions are rare just doesn't match with 
>> today's reality. Yes, there are some implementations that can't handle
them.
>> That is a very small percentage compared to the number of 
>> implementations that can't safely renegotiate (e.i. 100% of them). 
>> Those implementations already have to deal with a world in which 
>> extensions are real and common. They also have to deal with a world in 
>> which their code will need to be patched in order to be safe anyway.
>>
...
 
>I'd be very interested in seeing data on what fraction of existing servers
can't handle extensions. Is there any chance that you have measurements?

I am very interested in the statistical data of extensions supporting in the
real running Internet, too.
It will be meaningful when people discuss whether extension is used to solve
the vulnerability.

regards,
Min Huang