IETF Logo Mail Archive

[TLS] supported_versions question

Matt Caswell <frodo@baggins.org> Mon, 31 October 2016 18:43 UTC

Return-Path: <frodo@baggins.org>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 92F41129A0E for <tls@ietfa.amsl.com>; Mon, 31 Oct 2016 11:43:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZT7CUOSrlvVT for <tls@ietfa.amsl.com>; Mon, 31 Oct 2016 11:43:57 -0700 (PDT)
Received: from mx496502.smtp-engine.com (mx496502.smtp-engine.com [IPv6:2001:8d8:968:7d00::19:7e53]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5AEA9129A0B for <tls@ietf.org>; Mon, 31 Oct 2016 11:43:56 -0700 (PDT)
Received: from mail-qk0-f179.google.com (mail-qk0-f179.google.com [209.85.220.179]) by mx496502.smtp-engine.com (Postfix) with ESMTPSA id 59804CCA for <tls@ietf.org>; Mon, 31 Oct 2016 18:43:54 +0000 (GMT)
Received: by mail-qk0-f179.google.com with SMTP id z190so172388984qkc.2 for <tls@ietf.org>; Mon, 31 Oct 2016 11:43:54 -0700 (PDT)
X-Gm-Message-State: ABUngvdfuLHlWmlcGpOSsBcCC7GHKMIqaZpE8fe3h/vE31YQV3yeoT2nRXKnFPCny6PQa0Ottp63ZYV8KYpihw==
X-Received: by 10.55.102.130 with SMTP id a124mr22338845qkc.292.1477939432787; Mon, 31 Oct 2016 11:43:52 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.200.34.61 with HTTP; Mon, 31 Oct 2016 11:43:52 -0700 (PDT)
From: Matt Caswell <frodo@baggins.org>
Date: Mon, 31 Oct 2016 18:43:52 +0000
X-Gmail-Original-Message-ID: <CAMoSCWaVJy9f6NFy1Msc1_VSDxRFM2pruhecWb+22N4ct-t0+g@mail.gmail.com>
Message-ID: <CAMoSCWaVJy9f6NFy1Msc1_VSDxRFM2pruhecWb+22N4ct-t0+g@mail.gmail.com>
To: "tls@ietf.org" <tls@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/7nPB4L7dzSRkamSh1MEezMXj1ec>
Subject: [TLS] supported_versions question
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 31 Oct 2016 18:43:58 -0000

A few supported_versions questions:

1) What should a server do if supported_versions is received but
ClientHello.legacy_version != TLS1.2? Fail the handshake, or just
ignore legacy_version?

2) What should a server do if supported_versions is received,
ClientHello.legacy_version == TLS1.2, but supported_versions does not
contain TLS1.3 or TLS1.2 (e.g. it contains TLS1.1 or below)? Fail the
handshake, use the legacy_version, or use use the versions in
supported_versions?

3) If the answer to (2) above is ignore the legacy_version, and just
use the versions in supported_versions, which client_version should be
used in the RSA pre-master secret calculation? The one in
legacy_version, or the highest one in supported_versions? Presumably
it has to be the one in legacy_version, otherwise thing will fail when
the client talks to a server that doesn't understand
supported_versions?

Matt

v2.23.0 | Report a Bug | By Email