Subject: [ietf-tls] Re: London

From: Bodo Moeller <[email-masked]>
Date: Fri, 13 Jul 2001 19:01:12 +0200

On Fri, Jul 13, 2001 at 09:40:49AM -0700, Joseph Hui wrote:
>> From: Bodo Moeller [mailto:[email-masked]]

>>> Maybe now it's a good time to bring up an issue of compatibility
>>> that may cause grief during the dns_name roll-out: 
>>> 
>>>    dsn_name-server     : dns_name-browser,     works;
>>>    dns_name-server     : non-dns_name-browser, doesn't work;
>>>    non-dns_name-server : dns_name-browser,     doesn't work;
>>>    non-dns_name-server : non-dns_name-browser, doesn't work.

>> This is misleading.  SSL 3.0 and TLS 1.0 servers are required to
>> ignore extra data at the end of the ClientHello message, and obviously
>> non-dns_name servers would only be used in situations where the
>> dns_name extension is not needed (i.e., no name-based virtual
>> hosting).  Thus the only configuration that is problematic is when a
>> server requires dns_name, but the client does not support it.  This is
>> similar to the HTTP "Host" header situation some time ago.

> The context of discussion was about dns_name only.  
> I.e. the tabulation was only meant for dns_name deployment.
> (What else was the thread about?)

It is obvious that dns_name can be *used* only if it is supported both
by the client and the server.  Since the server implementation should
be selected depending on the needs of the specific site, why is it a
"compatibility" problem that non-dns_name servers would have to ignore
the dns_name extension?

But TLS extensions can cause compatibility problems even for
connections where they are not needed at all (see my previous
message).  When connecting to an HTTPS server, a browser does not know
whether dns_name is required for this specific connection or not.
Thus the dns_name extension would have to appear in *all* connection
attempts (ruling out use of the SSL 2.0 client hello format), and
*this* is a possible source of compatibility nightmares.

-- 
Bodo Möller <[email-masked]>
PGP http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller/0x36d2c658.html
* TU Darmstadt, Theoretische Informatik, Alexanderstr. 10, D-64283 Darmstadt
* Tel. +49-6151-16-6628, Fax +49-6151-16-6036

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]