Re: [TLS] When/why is the RSA premaster secret version rollback check needed?

["Brian Smith" <[e-mail]>]

Michael D'Errico wrote:
> > What attack is thwarted by checking the version number in the
> > premaster secret that isn't thwarted by the Finished message hash &
HMAC?
> 
> I think it is a "belt and suspenders" approach to security, which is a
good thing.
> It probably isn't strictly necessary.  You probably realize that with
DH-based
> cipher suites, the premaster secret can not include a version; thus if the
version
> check was actually critical, then DH would be less secure than RSA.  I
haven't
> heard anybody claim that to be true.

I guess the RSA encrypted premaster secret version check (REPMSVC) does
provide a mechanism for protecting version rollbacks even in the event that
an enabled SSL/TLS version's finished hash is be ineffective. But, the
finished hash is required for cipher suite rollback prevention, secure
renegotiation, defense against the Bleichenbacher/Klima attacks, defense
against version rollback attacks for non-RSA key exchange methods, and
probably more. The REPMSVC doesn't offer any of these protections, so it
seems it is now useless. 

In certain common situations, the TLS 1.2 spec's suggested defense against
the Klima attack exacts a notable performance penalty. Skipping the version
check completely can result in a notable savings on *every* RSA handshake,
completely avoid the Klima attack, and apparently prevent interoperability
problems with IE8. It seems clear to me that the pros and cons of
permanently disabling the check outweigh the potential benefits. However, I
am very eager to hear arguments to the contrary, in the event I am
overlooking something. Again, feedback is greatly appreciated.

Thanks again,
Brian