Subject: [ietf-tls] Re: London

From: David Hopwood <[email-masked]>
Date: Fri, 13 Jul 2001 00:47:38 +0100

-----BEGIN PGP SIGNED MESSAGE-----

Eric Rescorla wrote:
> "Joseph Hui" <[email-masked]> writes:
> 
> > It's reasonable to assume the context of dns_name discussion
> > to be always name-based virtual hosting.  So the compatibility
> > issue raised was specific for such practice.
>
> Well, that wasn't the compatibility issue that David was
> raising. There's a serious concern that if clients use this
> extension it will break servers who don't know about it.
> Such servers are broken but that's not much comfort to
> anyone concerned.

Can't the client simply re-connect if the server breaks (as least if it
can determine that this was the reason for the breakage)? SSL/TLS client
libraries already have to be designed in a way that allows them to
re-connect, in order to implement "Server Gated Cryptography" (either
the Microsoft or Netscape version, I can't remember which).

Perhaps we need to test various servers, and if necessary include
workarounds in the extensions draft, before publishing it as an RFC.

Re-connection should also work as a way of fixing the problem of some
SSL servers not tolerating a version number of {3, 1} in the encrypted
pre-master secret. I'll think about that some more and post the details.

- -- 
David Hopwood <[email-masked]>

Home page & PGP public key: http://www.users.zetnet.co.uk/hopwood/
RSA 2048-bit; fingerprint 71 8E A6 23 0E D3 4C E5  0F 69 8C D4 FA 66 15 01
Nothing in this message is intended to be legally binding. If I revoke a
public key but refuse to specify why, it is because the private key has been
seized under the Regulation of Investigatory Powers Act; see www.fipr.org/rip

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]