Subject: [TLS] [Technical Errata Reported] RFC5246 (5036)

From: RFC Errata System <[email-masked]>
Date: Fri, 9 Jun 2017 06:55:02 -0700 (PDT)

The following errata report has been submitted for RFC5246,
"The Transport Layer Security (TLS) Protocol Version 1.2".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata/eid5036

--------------------------------------
Type: Technical
Reported by: Stefan Goeman <[email-masked]>

Section: 7.4.1.2

Original Text
-------------
The ClientHello Structure indicates that a SessionID could be present.
However if I take a wireshark of a TLS session I always see a "Session 
ID Length" field, either with value 0 or value 32

Corrected Text
--------------
In the ClientHello structure and ServerHello structure, include 
a 1 byte "Session ID Length" field.

Notes
-----
The ClientHello Structure indicates that a SessionID could be present.
However if I take a wireshark of a TLS session I always see a 
"Session ID Length" field, either with value 0 or value 32.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC5246 (draft-ietf-tls-rfc4346-bis-10)
--------------------------------------
Title               : The Transport Layer Security (TLS) Protocol Version 1.2
Publication Date    : August 2008
Author(s)           : T. Dierks, E. Rescorla
Category            : PROPOSED STANDARD
Source              : Transport Layer Security
Area                : Security
Stream              : IETF
Verifying Party     : IESG

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 9 Jun 2017 15:02:59 +0100

This erratum is incorrect.

Here is the definition of SessionID:
      opaque SessionID<0..32>;

The angle brackets mean that it is variable length and the 0..32 means that
there is
a one-byte length field.

On Fri, Jun 9, 2017 at 2:55 PM, RFC Errata System <[email-masked]
> wrote: