Subject: [ietf-tls] Re: London

From: "Jan Mikkelsen" <[email-masked]>
Date: Fri, 13 Jul 2001 18:40:38 +1000

David Hopwood <[email-masked]> wrote:
>Eric Rescorla wrote:
>> Well, that wasn't the compatibility issue that David was
>> raising. There's a serious concern that if clients use this
>> extension it will break servers who don't know about it.
>> Such servers are broken but that's not much comfort to
>> anyone concerned.
>
>Can't the client simply re-connect if the server breaks (as least if it
>can determine that this was the reason for the breakage)? SSL/TLS
client
>libraries already have to be designed in a way that allows them to
>re-connect, in order to implement "Server Gated Cryptography" (either
>the Microsoft or Netscape version, I can't remember which).
>
>Perhaps we need to test various servers, and if necessary include
>workarounds in the extensions draft, before publishing it as an RFC.
>
>Re-connection should also work as a way of fixing the problem of some
>SSL servers not tolerating a version number of {3, 1} in the encrypted
>pre-master secret. I'll think about that some more and post the
details.

Some time ago, Jay Kistler did some simple tests against deployed
servers (Apache/OpenSSL, IIS 4, IIS 5, Netscape Enterprise 3.5 & 3.6) by
sending a TLS ClientHello with extra data on the end.

Apache/OpenSSL & IIS 5 successfully established a session, I think the
others failed with a version error.  At the time, our (my, Jay Kistler &
Rene Eberhard) thinking was exactly the same as David's:  That the
client would attempt reconnection with a lower version.  We did the
tests to make sure that servers didn't break outright.

Jan Mikkelsen

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]