Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This is wonderful!

I may make a version where the bytes used for lengths are highlighted, since it feels like so many bytes are lengths; look at the SNI extension, which has three 16-bit lengths, I know why they're there, but SNI probably shouldn't be a list, and even if it was a list, an extension that consists solely of a list has a list of the length of the extension, you shouldn't need two bytes for that, and if we recast sni into just a type and a string, the string is clearly going to take the rest of the extension length, so it doesn't need a two byte length either.



Agreed, and I think some pain must have gone into those redundant length bytes. The way they've done it makes it very easy and natural to extend any part of any record later, but it gets ridiculous when you have to document them.


Moreover, from a security perspective since we're talking about TLS, "overspecified" and/or "redundant" lengths are just begging to be made inconsistent and a source of vulnerabilities.


Usually if you mess up something there your implementation just doesn't work.


Vulnerabilities often arise from implementation bugs, no?


Yeah, but not every implementation details will equally lead to the same vulnerabilities. Having said that, heartbleed was a length issue.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: