Subject: [ietf-tls] Re: Re: London

From: "John Banes" <[email-masked]>
Date: Sun, 15 Jul 2001 15:20:34 -0700

> -----Original Message-----
> From: Peter Gutmann [mailto:[email-masked]]
> Sent: Sunday, July 15, 2001 7:13 PM
> To: IETF Transport Layer Security WG
> Subject: [ietf-tls] Re: Re: London
> 
> 
> Bodo Moeller <[email-masked]> writes:
> 
> >SSL 3.0 and TLS 1.0 servers are required to ignore extra 
> data at the end of
> >the ClientHello message, 
> 
> The servers are required to ignore extra data, and 
> implementors may even have
> tried to implement this, but until clients come along which 
> include extra data
> it won't be possible to tell whether they handle this 
> properly or not.  It may
> well be that some widely-deployed server doesn't get it quite 
> right, which will
> cause serious deployment problems.

Agreed. Odds are, one or more major SSL server implementations will choke when faced with a client_hello message that contains extra data.

> 
> >TLS extensions can only be used in SSL 3.0 and TLS 1.0 
> ClientHello messages,
> >not in SSL 2.0 CLIENT-HELLO messages.  While it is time to 
> give up the actual
> >SSL 2.0 protocol, the SSL 2.0 CLIENT-HELLO format still play 
> an important role
> >for protocol version negotiation, and handshakes usually 
> start using this
> >format.
> 
> Only Netscape does it, I've never seen IE start with v2 (in 
> fact Netscape
> always sends a v2 hello no matter what you do, even with 
> SSLv2 turned off).
> Given that IE doesn't send a v2 hello, I think it's safe to 
> assume that
> everything can handle v3 hellos.
> 

Internet Explorer sends an SSL2-format client_hello message by default, since the SSL2 protocol is still enabled by default. IE does send an SSL3-format client_hello message if the user has disabled the SSL2 protocol, though. 

Regards,

John Banes
Microsoft Corp.

> Peter.
> 
> 
> ---
> You are currently subscribed to ietf-tls as: 
> [email-masked]
> To unsubscribe send a blank email to 
> [email-masked]
> 

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]