crypto/tls: support ECDHE key exchanges when ec_point_formats is missing in ClientHello extension

[yang-wei]

What did you do?

Per rfc8422#section-5.1.2,

For backwards compatibility purposes, the point format list extension MAY still be included and contain exactly one value: the uncompressed point format (0). RFC 4492 specified that if this extension is missing, it means that only the uncompressed point format is supported, so interoperability with implementations that support the uncompressed format should work with or without the extension

We are seeing TLS handshake failure (client and server failed to agree on ECDHE_ECDSA key exchange algorithem) when ec_point_formats is missing because we expect it to be listed in tls/handshake_server.go

// supportsECDHE returns whether ECDHE key exchanges can be used with this
// pre-TLS 1.3 client.
func supportsECDHE(c *Config, supportedCurves []CurveID, supportedPoints []uint8) bool {
...
	supportsPointFormat := false
	for _, pointFormat := range supportedPoints {
		if pointFormat == pointFormatUncompressed {
			supportsPointFormat = true
			break
		}
	}

	return supportsCurve && supportsPointFormat
}

What did you expect to see?

If ec_point_formats is missing in ClientHello, we will allow ECDHE key exchanges because it means that only the uncompressed point format is supported

[gopherbot]

Change https://golang.org/cl/358116 mentions this issue: crypto: support ECDHE when ec_point_formats is missing in ClientHello

[seankhliao]

cc @FiloSottile

[yang-wei]

Hey, how is everything? Any updates on this?

[wqweto]

This issue is affecting Windows 11 and Windows Server 2022 built-in Schannel library latest TLS 1.3 implementation.

It seems TLS1_3_CLIENT sends supported_groups (10) extension but does not send ec_point_formats (11) on ClientHello message.

Sites unreachable by TLS1_3_CLIENT:

• https://www.howsmyssl.com/
• https://clienttest.ssllabs.com:8443/ssltest/viewMyClient.html

[wqweto]

@yang-wei Did see this part from @gopherbot reply on PR #49127?

During May-July and Nov-Jan the Go project is in a code freeze, during which little code gets reviewed or merged. If a reviewer responds with a comment like R=go1.11 or adds a tag like "wait-release", it means that this CL will be reviewed as part of the next development cycle. See https://golang.org/s/release for more details.