Re: [TLS] Last Call: <draft-ietf-tls-downgrade-scsv-03.txt> (TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks) to Proposed Standard

[Nikos Mavrogiannopoulos <[e-mail]>]

On Wed, 2015-01-21 at 11:16 +0200, Yoav Nir wrote:
> Thanks

> In that case, I think my implementation would fail with (1.3,1.3).
> Since I can’t know what changes TLS 1.3 made to the record layer, I
> can’t be sure that I understand what I’m parsing. Perhaps those bytes
> that I thought were the ClientHello are actually some new fields that
> were added to the record header.

You can know that. It is mentioned in rfc5246:
https://tools.ietf.org/html/rfc5246#appendix-E.1

"TLS servers compliant with this specification MUST accept any value
{03,XX} as the record layer version number for ClientHello."

It is, then, explicit that the record format cannot change without
changing the TLS major version from 03 to 04 or so.

> If the record layer version exceeds what the server supports, I think
> it wouldn’t be prudent to reply with anything but an alert. Many
> implementations treated the record layer version in the ClientHello as
> a minimum version number. Yes, I know this goes against a MUST
> requirement in appendix E.1 or RFC 5246, but as that appendix says,
> this is behavior that is often implemented.

Well, we can only interoperate as long as we implement the same
protocol, and the protocol is specific on what to do in that case.

regards,
Nikos