Re: [Cfrg] [TLS] Salsa20 stream cipher in TLS

[Yoav Nir <[e-mail]>]

On Mar 22, 2013, at 1:23 AM, Martin Rex <[e-mail]> wrote:

> Adam Langley wrote:
>> On Thu, Mar 21, 2013 at 8:09 AM, Yoav Nir <[e-mail]> wrote:
>>> 
>>> Actually, we turned on TLS 1.2 by default for the speed advantage.
>>> iOS begins a TLS handshake with version 1.2, both in ClientHello
>>> and in the record layer. Only when the (shocked and flabbergasted)
>>> server closes the connection, does the iPhone try with something
>>> more sane like 1.0, and then even caches this for a short while.
> 
> Are you sure?
> 
> It would clearly be stupid behaviour on part of iPhone to send an
> initial ClientHello with { 0x03, 0x03 } at the record layer.

It would be, and it was. This was long ago, so it may have been fixed in iOS 6.

> 
> It should be sending this version in ClientHello.client_version alone.
> 
>> 
>> But you don't need to switch on TLS 1.2 to fix this, right? The server
>> just needs to implement version negotiation correctly.
> 
> The servers typically implement it correctly.  If iPhone is willing
> to talk a protocol version < TLSv1.2, then using TLSv1.2 on the
> Record Layer on the first ClientHello is a stupid bug. 
> 
> Only(!!) TLSv1.2 servers will ignore the record layer PDU version
> on the initial ClientHello (but for them this is currently entirely
> irrelevant, since there is no TLSv1.3 and no borked TLSv1.3 clients
> that tag PDUs incorrectly).
> 
> 
> -Martin
> 
> Email secured by Check Point