Re: [TLS] SCSVs and SSLv3 fallback

[[e-mail] (Martin Rex)]

Yngve N. Pettersen wrote:
>
> Even with the reminder about tolerance in RFC 5746 0.15% of renego patched  
> servers are extension (88%) and/or version intolerant (24%) in the TLS 1.0  
> to TLS 1.2 range, and the reason they are still around is that the other  
> clients have not enforced a no-rollback policy for renego patched servers.  
> Overall, 14.7% are intolerant for those in the 3.x and/or 4.x range.

Huh? -------------------------------------------------------^^^

Why would you ever check for 4.xx version numbers?

Rejecting 4.x version numbers is perfectly OK for TLS servers!

rfc5246 says:
                                                          TLS servers
   compliant with this specification MUST accept any value {03,XX} as
   the record layer version number for ClientHello.

   TLS clients that wish to negotiate with older servers MAY send any
   value {03,XX} as the record layer version number.

A TLS client that uses a version {04,00} at the record layer or in
ClientHello.client_version is squarely in undefined territory,
and every conceivable server behaviour is perfectly compliant
with the TLSv1.2 spec.  (Personally, however, I believe that
crashing is never a valid option for the server).


-Martin