1752511 - NSS sends a Hello Retry Request if a Key Share extension is missing in a TLS 1.3 Client Hello

Status: UNCONFIRMED

(NSS :: Libraries, defect, P3)

Description

[m.maehren]

Attachment: nss-noKeyShareExtension_HRR.pcapng

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36

Actual results:

Upon receiving a Client Hello that contains a Supported Versions extension offering TLS 1.3 and a Supported Groups extension but no Key Share extension, NSS sends a Hello Retry Request.

Expected results:

According to RFC 8446 NSS should abort with a missing_extension alert:

Section 9.2. Mandatory-to-Implement Extensions:
A client is considered to be attempting to negotiate using this
specification if the ClientHello contains a "supported_versions"
extension with 0x0304 contained in its body. Such a ClientHello
message MUST meet the following requirements:
[...]

If containing a "supported_groups" extension, it MUST also contain
a "key_share" extension, and vice versa.  An empty
KeyShare.client_shares vector is permitted.

Servers receiving a ClientHello which does not conform to these
requirements MUST abort the handshake with a "missing_extension"
alert.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:beurdouche, could you have a look please?

For more information, please visit auto_nag documentation.