1. TLS Record Layer Bugs Pasi.Eronen@nokia.com IETF67 TLS WG

2. Background Testing inspired by Yngve’s draft No illegal inputs (overflows etc.)

3. Fragmentation “multiple client messages of the same ContentType MAY be coalesced into a single TLSPlaintext record, or a single message MAY be fragmented across several records”

4. Fragmentation: test results OpenSSLfail Microsoft IISfail Mozilla NSSOK CerticomOK GnuTLSOK Sun JSSEOK Cryptlibfail PureTLSfail TLSLitefail MatrixSSLfail

5. Fragmentation: proposal MUST NOT fragment Handshake, Alert, and CCS messages Unless larger than max. fragment size …At least when using TLS_NULL_WITH_NULL_NULL?

6. Empty fragments: test results OpenSSLfail Microsoft IISfail Mozilla NSSfail CerticomOK GnuTLSOK Sun JSSEfail Cryptlibfail PureTLSfail TLSLitefail MatrixSSLfail

7. Empty fragments: proposal MUST NOT send empty fragments … with Handshake/Alert/CCS content type only?

8. Large padding “padding MAY be any length up to 255 bytes, as long as it results in the TLSCiphertext.length being an integral multiple of the block length”

9. Large padding: test results OpenSSLOK Microsoft IIS OK Mozilla NSSOK CerticomOK GnuTLSOK Sun JSSE OK CryptlibOK PureTLSOK TLSLiteOK MatrixSSLfail

10. Unknown content types “If a TLS implementation receives a record type it does not understand, it SHOULD just ignore it.”

11. Unknown content: test results OpenSSLOK Microsoft IIS fail Mozilla NSSfail Certicomfail GnuTLSfail Sun JSSE OK Cryptlibfail PureTLSfail TLSLitefail MatrixSSLfail

12. Unknown content: proposal MUST NOT send other content types except when negotiated using a TLS extension

13. Summary I have some more tests… Anyone interested in more testing? –SSL accelerator boxes? –Lotus Domino?