On Saturday 26 September 2015 01:02:15 Viktor Dukhovni wrote:
> On Sat, Sep 26, 2015 at 12:17:20AM +, Salz, Rich wrote:
> > > On the other side of the coin handling very large ClientHello's is
> > > not without cost and risk.
> >
> > As long as it's a #define that can be changed in ssl.h (or
On Friday 25 September 2015 16:33:40 Matt Caswell wrote:
> On 25/09/15 14:19, Hubert Kario wrote:
> > Current OpenSSL-1.0.1, 1.0.2 as well as state-machine-rewrite
> > branches reject Client Hello messages bigger than 2^14+4 bytes.
>
> Right. The reason for that is that there is an explicit
On Fri, Sep 25, 2015 at 09:19:02PM +0200, Kurt Roeckx wrote:
> Since we don't actually know how things are going to change in the
> future and that they can change the maximum size of a Client
> Hello, it makes sense to me to not enforce a limit for the Client
> Hello message just because that's
On Fri, Sep 25, 2015 at 04:23:27PM +, Hubert Kario via RT wrote:
>
> Given that TLSv1.3 has a 1RTT mode planned (so Client Key Exchange ends
> up as an extension, possibly multiple ones), and that quantum computing
> resistant algorithms usually require fairly large key sizes (large
>
On Fri, Sep 25, 2015 at 04:23:27PM +, Hubert Kario via RT wrote:
>
> Given that TLSv1.3 has a 1RTT mode planned (so Client Key Exchange ends
> up as an extension, possibly multiple ones), and that quantum computing
> resistant algorithms usually require fairly large key sizes (large
>
On 25/09/15 20:19, Kurt Roeckx wrote:
> On Fri, Sep 25, 2015 at 04:23:27PM +, Hubert Kario via RT wrote:
>>
>> Given that TLSv1.3 has a 1RTT mode planned (so Client Key Exchange ends
>> up as an extension, possibly multiple ones), and that quantum computing
>> resistant algorithms usually
> On the other side of the coin handling very large ClientHello's is not without
> cost and risk.
As long as it's a #define that can be changed in ssl.h (or a runtime global?
Ick) we should be okay.
___
openssl-dev mailing list
To unsubscribe:
On Sat, Sep 26, 2015 at 12:17:20AM +, Salz, Rich wrote:
> > On the other side of the coin handling very large ClientHello's is not
> > without
> > cost and risk.
>
> As long as it's a #define that can be changed in ssl.h (or a runtime global?
> Ick) we should be okay.
It would have to
