Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 92F41129A0E for ; Mon, 31 Oct 2016 11:43:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZT7CUOSrlvVT for ; Mon, 31 Oct 2016 11:43:57 -0700 (PDT) Received: from mx496502.smtp-engine.com (mx496502.smtp-engine.com [IPv6:2001:8d8:968:7d00::19:7e53]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5AEA9129A0B for ; Mon, 31 Oct 2016 11:43:56 -0700 (PDT) Received: from mail-qk0-f179.google.com (mail-qk0-f179.google.com [209.85.220.179]) by mx496502.smtp-engine.com (Postfix) with ESMTPSA id 59804CCA for ; Mon, 31 Oct 2016 18:43:54 +0000 (GMT) Received: by mail-qk0-f179.google.com with SMTP id z190so172388984qkc.2 for ; Mon, 31 Oct 2016 11:43:54 -0700 (PDT) X-Gm-Message-State: ABUngvdfuLHlWmlcGpOSsBcCC7GHKMIqaZpE8fe3h/vE31YQV3yeoT2nRXKnFPCny6PQa0Ottp63ZYV8KYpihw== X-Received: by 10.55.102.130 with SMTP id a124mr22338845qkc.292.1477939432787; Mon, 31 Oct 2016 11:43:52 -0700 (PDT) MIME-Version: 1.0 Received: by 10.200.34.61 with HTTP; Mon, 31 Oct 2016 11:43:52 -0700 (PDT) From: Matt Caswell Date: Mon, 31 Oct 2016 18:43:52 +0000 X-Gmail-Original-Message-ID: Message-ID: To: "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: [TLS] supported_versions question X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 31 Oct 2016 18:43:58 -0000 A few supported_versions questions: 1) What should a server do if supported_versions is received but ClientHello.legacy_version != TLS1.2? Fail the handshake, or just ignore legacy_version? 2) What should a server do if supported_versions is received, ClientHello.legacy_version == TLS1.2, but supported_versions does not contain TLS1.3 or TLS1.2 (e.g. it contains TLS1.1 or below)? Fail the handshake, use the legacy_version, or use use the versions in supported_versions? 3) If the answer to (2) above is ignore the legacy_version, and just use the versions in supported_versions, which client_version should be used in the RSA pre-master secret calculation? The one in legacy_version, or the highest one in supported_versions? Presumably it has to be the one in legacy_version, otherwise thing will fail when the client talks to a server that doesn't understand supported_versions? Matt