Re: [TLS] Minutes from Tuesday

[Brian Smith <[e-mail]>]

Martin Rex <[e-mail]> wrote:
> It's actually hard to think of a more unreasonable behaviour than
> the one currently specified.

No it isn't. For example, the server could do all of these, which are
more unreasonable:
1. Reboot the server.
2. Start thermonuclear war.
3. Send a reply on this thread to this mailing list.

There are many other more unreasonable things the server could do.

> A different, equally simple and magnitudes more useful server behaviour
> would be for the server to continue the handshake as normal and simply
> assume in the processing of the ClientHello that the Client means
> ClientHello.client_version +1 compared to what it sent over the wire.

No, because the client might have done multiple levels of fallback,
but the server might not have seen all of the levels. So, for example,
the server might be seeing ClientHello.client_version = SSL 3.0 with
the fallback SCSV, but the client actually supports TLS 1.2. It
wouldn't be good for the server to carry on with TLS 1.0 (because of
the CBC IV problems in TLS 1.0, amongst other reasons).

> (but when doing that, the server ought to skip the RSA premaster secret
>  client_version check later on when selecting a cipher suite with
>  static RSA key exchange.  Since Microsoft botched the RSA premaster
>  secret version on renegotiation handshakes in Win7, and there is no
>  security value in the check anyway, this should be perfectly OK.)

I disagree. If there is a compatibility issue regarding renegotiations
only, then the compatibility workaround should be limited to
renegotiations only. Since most clients don't even want to renegotiate
unless the server demands it, limiting the workaround to
renegotiations means that most connections will never be affected by
it.

Cheers,
Brian