Re: Concluding discussion on #612 (9.2.2)

On 11 October 2014 09:23, Ilari Liusvaara <ilari.liusvaara@elisanet.fi>
wrote:

> Nope, all ciphers it gave are both acceptable for it and 9.2.2-compliant.


So there is no problem.  Any cipher the server picks is acceptable to the
client for h2, so the handshake will succeed.

If the server does not know XYZ and thus decides to not accept it according
to 9.2.2, then the handshake will fail unless there is another cipher suite
(or protocol) that the server is prepared to talk.  If failure occurs in
this circumstance, then it is because there is not a mutually acceptable
cipher/protocol pair.    The server is entitled to reject XYZ if it does
not know it.  Or the server can be more trusting and say that it does not
know XYZ, but the client is prepared to speak it for h2, so it will also.
That all depends on the server security policy - which it is entitled to
enforce.

Handshake failures may still happen if there are no mutually acceptable
cipher/protocol pairs.   The issue I want to see fixed is the handshake
failures when there are mutually acceptable cipher/protocol pairs.

regards





-- 
Greg Wilkins <gregw@intalio.com>  @  Webtide - *an Intalio subsidiary*
http://eclipse.org/jetty HTTP, SPDY, Websocket server and client that scales
http://www.webtide.com  advice and support for jetty and cometd.