Subject: [TLS] Wikipedia TLS Comparison page

From: Simon Josefsson <[email-masked]>
Date: Wed, 09 Feb 2011 21:46:01 +0100

All,

I have been updating the following Wikipedia article with information on
different TLS implementations and their features.  Finding the
information by looking at source code is time-consuming (and error
prone), but I think it is alreadyinteresting in the way that it shows
that no TLS implementation supports all protocol features.  If you are
so inclined, please help to improve the page with useful information.
And by all means, fix any mistakes on it.

http://en.wikipedia.org/wiki/Comparison_of_TLS_Implementations

/Simon

---

From: Yoav Nir <[email-masked]>
Date: Thu, 10 Feb 2011 11:33:51 +0200

Nice. 

I've added some of the data about Microsoft's library; I called it SChannel, because that's what it says in MSDN. Hopefully, somebody who knows better will update the page with the missing info.

On Feb 9, 2011, at 10:46 PM, Simon Josefsson wrote:

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
> 
> Scanned by Check Point Total Security Gateway.

---

From: Martin Rex <[email-masked]>
Date: Thu, 10 Feb 2011 20:12:52 +0100 (MET)

Yoav Nir wrote:
> 
> I've added some of the data about Microsoft's library;
> I called it SChannel, because that's what it says in MSDN.
> Hopefully, somebody who knows better will update the page
> with the missing info.

While it would be helpful to have an overview of the features
of Microsoft SChannel available somewhere, I doubt such a description
fits into this particular list.
The original stated goal is offering a comparison to facilitate a _choice_.
With Microsoft SChannel, there is _no_ choice.  Windows 7 SChannel is
available only on Windows 7.  Other windows plattforms (of which there
are plenty, e.g. XP,2003,CE) have their own SChannel implementations
with significantly differing capabilities and defaults.

Correctly describing the features of implementations is also pretty
difficult, because these implementations may have several independently
maintained codelines, with differing features and differing default
bevhaviour.  It may also not be immediately obvious whether a
feature is not supported (aka not implemented), only defaults to off,
or is buggy (and not being fixed).

For Windows7 SChannel, TLSv1.2 and HMAC-256 seems off by default,
SSLv2, RSA_EXPORT and RC4-40 are available, but off by default, at least
for the client.

Since we recently submitted a document for deprecating SSLv2 support--
it would be interesting to know which implementations support the
SSL 2.0 CLIENT-HELLO at the beginning of an SSLv3 or TLSv1.x handshake,
and the default max. TLS version propsed by the client.

The still is a HUGE installed base of TLS that sends SSL 2.0 CLIENT-HELLO.
Basically all of MSIE (6,7,8) on Windows XP appears to be sending it,
because XP originally shipped with SSLv2 enabled.  Those doing business
for https:-based browser frontends to customers _really_ want their
servers to accept SSL 2.0 CLIENT-HELLO as the first handshake message,

-Martin

---

From: Wan-Teh Chang <[email-masked]>
Date: Thu, 10 Feb 2011 11:50:51 -0800

> http://en.wikipedia.org/wiki/Comparison_of_TLS_Implementations

Thank you for creating this page.  Bob Relyea and I have updated the NSS info.

Some of the info is biased.  For example, obscure TLS extensions,
including truncated HMAC that no SSL library implements, are listed,
but the certificate status request extension (aka OCSP stapling) is
not listed.

You may want to omit the support for US "export" grade crypto
(RSA-EXPORT and RC4-40) to save space.  Nobody should evaluate an SSL
library based on that today.

Wan-Teh Chang

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Thu, 10 Feb 2011 15:03:09 -0500

On 02/10/2011 02:50 PM, Wan-Teh Chang wrote:
> Thank you for creating this page.  

Yes, thank you Simon!

> Bob Relyea and I have updated the NSS info.

Thanks to both of you for that.

> but the certificate status request extension (aka OCSP stapling) is

Adding a column for OCSP stapling would be a nice improvement to the
page.  Please do it!

	--dkg

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Thu, 10 Feb 2011 21:18:24 +0100

> including truncated HMAC that no SSL library implements, are listed,
[...]

To me it still serves a purpose... We wouldn't know that no-one
implemented that if that page wasn't there :)

> (RSA-EXPORT and RC4-40) to save space.  Nobody should evaluate an
> SSL library based on that today.

Indeed, but it is a way for someone to see that they are still
in existence.

regards,
Nikos

---

From: Yoav Nir <[email-masked]>
Date: Thu, 10 Feb 2011 22:58:42 +0200

> fits into this particular list.

I think that depends on your situation. When we (my company) wanted to write an SSL-based client for Windows, we had a choice of using OpenSSL, SChannel, rolling our own, or licensing one of those that are available for licensing. SChannel was clearly a viable choice, and finally it was chosen, because that made the binary smaller (the SSL library was already there).

> with significantly differing capabilities and defaults.

Sure, and what works on Windows XP, will work the same way on Windows Vista, 7, 2003, and 2008, and pretty much the same on CE or whatever they call it these days.

If you want newer features, you need the newer operating system. If I had a lot of time on my hands, I would split that table to Schannel-XP, SChannel-Vista and SChannel-7. As it is, I wrote what I know about Windows 7. But I agree that it's much easier to migrate to the latest OpenSSL, than to force your users to migrate to Windows 7. 

> or is buggy (and not being fixed).

As far as I found it (I only invested 10-15 minutes in this) I used packet capture and MSDN

> SSLv2, RSA_EXPORT and RC4-40 are available, but off by default, at least

I think you're conflating SChannel with Internet Explorer. IE does have TLSv1.2 and 1.1 off by default, but when programming your own application, it's all up to the parameters you configure.

> servers to accept SSL 2.0 CLIENT-HELLO as the first handshake message,

I agree. You can easily run a client today without SSLv2 at all, but now a web server. Even our proprietary TLS library (which I didn't list because it's not available) supports SSLv2 client hellos. Last data I've seen is the IE6 is still 20% of the web, and XP is still huge.  Are you sure about IE7/8 offering SSLv2 by default on XP?  I thought that was gone.

Yoav

---

From: Xuelei Fan <[email-masked]>
Date: Fri, 11 Feb 2011 07:36:21 +0800

Thank you Simon for creating this page.

>  SSLv2, RSA_EXPORT and RC4-40 are available, but off by default,
>  at least for the client.

It maybe helpful to list what are the default and supported protocols 
and cipher suites for client and server.

Except the TLS specification, some other features, for example 
Certificate status (CRL/OCSP) checking, cryptographic strength(supported 
key size and default key size), may be also the aspects need to 
consider. However, these points may be more suitable in the wiki of the 
back-end crypto implementation.

Thanks,
Xuelei