Re: [Cfrg] [TLS] Salsa20 stream cipher in TLS

[Yoav Nir <[e-mail]>]

On Mar 21, 2013, at 8:18 AM, Adam Langley <[e-mail]> wrote:

> On Thu, Mar 21, 2013 at 8:09 AM, Yoav Nir <[e-mail]> wrote:
>> Actually, we turned on TLS 1.2 by default for the speed advantage. iOS begins a TLS handshake with version 1.2, both in ClientHello and in the record layer. Only when the (shocked and flabbergasted) server closes the connection, does the iPhone try with something more sane like 1.0, and then even caches this for a short while.
> 
> But you don't need to switch on TLS 1.2 to fix this, right? The server
> just needs to implement version negotiation correctly.

We consider the record layer version to be the minimum version supported by the client, and the version in the ClientHello to be the maximum version supported by the client. Since both were 1.2, our code concludes that TLS 1.2 is the only supported version. We tried replying in TLS 1.0, and we got a TCP reset or an alert (I forget which). So without TLS 1.2 support, the first connection would always fail. In practice this wouldn't be a problem, because the phone would get the penalty once, and then cache the information that our server doesn't support 1.2. Still, we preferred to add support for TLS 1.2 (which I wanted to do anyway)

> (On the flip side, this /is/ a problem for clients since the
> incentives are aligned for clients to stop trying TLS 1.2 since they
> can't (directly) fix the server.)
> 
> 
> Cheers
> 
> AGL
> 
> Email secured by Check Point