Subject: Re: [TLS] I-D ACTION:draft-ietf-tls-rfc2246-bis-11.txt

From: "Yngve N. Pettersen (Developer Opera Software ASA)" <[email-masked]>
Date: Wed, 01 Jun 2005 03:38:58 +0200

On Tue, 31 May 2005 17:15:33 -0700, EKR <[email-masked]> wrote:

> "Yngve Nysaeter Pettersen" <[email-masked]> writes:
>
>> Hello all,
>>
>> A couple of question and comments:
>>
>> Sec. 6 says "If a TLS implementation receives a record type it does not
>> understand, it SHOULD just ignore it."
>>
>> If such a record is received after the parties have started encrypting
>> the  records, should it try to decrypt the data, or should the
>> implementation  throw the record away immediately?
>
> Well, for RC4 you have to at least skip ahead to the next
> section of keystream. With the block ciphers in TLS 1.1 you
> can just discard the record. Otherwise, I think it's implementation
> dependent.

OK.

>> About compatibility: Back in August/September 2004 Opera Software
>> performed a test where we released a Technology Preview version of
>> Opera  with TLS 1.1 and TLS Extensions enabled. During this test our
>> users  identified more than 120 services (including major banks) that
>> did not  interoperate with a client using either TLS 1.1 or TLS
>> Extensions, or  both. I have so far not been able to find out what is
>> causing the problem.
>
> You mean aside from noone actually implementing them? :)
>
> Was there some other problem?

Yes. The mentioned servers (or their surround support systems) did not  
tolerate clients that used TLS 1.1, or TLS extensions, or both. The most  
common response (but not the only one) to a Client Hello including one or  
both of them is to shut down the connection, without any alert messages  
whatsoever.

There are a number of variations, some servers would accept either, but  
not both; others would accept TLS 1.1 and extensions, but not TLS 1.0 with  
extensions, and so on. I classified 5 major types of problems.

Some minor variations also existed: One TLS 1.0 capable server actually  
negotiated SSL v3 when the client asked for TLS 1.1. Another used an  
incorrect version number (the negotiated) when checking the RSA Premaster  
Secret.

In one case I saw one server that initially only cut the connection when a  
TLS 1.1 Hello was sent change to also cutting the connection when TLS  
Extensions were used, a few weeks later.

See the top post in  
http://my.opera.com/forums/showthread.php?s=&threadid=65055 for more  
examples.

For those interested, Opera 8.0 ships with TLS 1.1 (it still support  
export ciphers) and TLS Server Name Extension support, both controlled by  
the TLS 1.1 setting, which is disabled by default.

-- 
Sincerely,
Yngve N. Pettersen
 
********************************************************************
Senior Developer                     Email: [email-masked]
Opera Software ASA                   http://www.opera.com/
Phone:  +47 24 16 42 60              Fax:    +47 24 16 40 01
********************************************************************

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls