Richard Levitte - VMS Whacker wrote:
>
> I've been hit with a problem that makes me think very much of SGC, and
> started searching for docs. The best documents so far are found as
> links from http://www.microsoft.com/security/tech/sgc/default.asp,
> most importantly, the protocol is roughly described in
> http://www.microsoft.com/security/tech/sgc/TechnicalDetails.asp .
> According to that one, the client doing SGC the M$ way sends a Reset
> message to the server as an answer to the server cert. According to
> the same page, Netscape clients do almost the same thing, except they
> do a full handshake before renegotiating (I feel a bit unsure about if
> Netscape clients actually close the connection and do a new connection
> with a stronger cipher or if it sends a reset message like M$ clients
> do).
>
Neither sends a "reset message" since there's no such thing :-)
MSIE just (illegally) sends the second client hello. Netscape follows
the spec: it finishes the handshake, closes the session then starts
another.
> Looking around in our source, all I can see is that we detect if
> there's a suddent client hello coming when OpenSSL is in the client
> certificate reading state. However, if the technical details page
> given above is correct, OpenSSL should receive the mysterious Reset
> message when getting the request from an M$ client, won't recognise
> it, and will thusly fail the SSL_accept().
>
> I wonder, is there anyone knowing if the alleged Reset message is
> really an existing thing or just a way to show that the server should
> implicitely expect this to possibly happen? The next question would
> be what the message type code is, and what the contents of the packet
> might be, if any.
>
> Also, one might wonder how it really works in the Netscape world.
>
> So many question, so little info (really, the technical info I've
> found so far is crapy at best, and I can't find the document that M$
> has supposedly sent to IETF either... *sigh*).
>
When I added SGC support I did various tests. The behaviour depends on
the extensions present in the certificates. If the SGC extension is
present then an MS browser will do SGC. If only the Netscape "step up"
extension is present then it will do the full Netscape handshake.
However in my experience the Netscape handshake was broken on MSIE and
would only work if the start and end ciphers where RC4, that is only 40
bit and 128 bit RC4 were enabled on the first connection. After the
first connection it recognised the server as being SGC and would use any
cipher suite.
Netscape however only does step up.
Anyway can you give more specific details of the problem you've hit?
Steve.
--
Dr Stephen N. Henson. http://www.drh-consultancy.demon.co.uk/
Personal Email: [EMAIL PROTECTED]
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the OpenSSL project: http://www.openssl.org/
Business Email: [EMAIL PROTECTED] PGP key: via homepage.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
