Re: [TLS] Minutes from Tuesday

[[e-mail] (Martin Rex)]

Bodo Moeller wrote:
>
> Manuel Pégourié-Gonnard <[e-mail]>:
> 
>> Martin Rex wrote:
>>> Bodo Moeller wrote:
>>>> [...] reacting to a fatal alert is something that all TLS
>>>> implementations already know how to do.
>>
>>> That reaction is called interop failure.  That is the far opposite
>>> of what IETF working groups are supposed to consciously cause to happen
>>> when the alternative would be to make interop succeed.
> 
>> 
>> the benefits of the solution you suggest, but I think the simplicity of the
>> current draft is a big advantage in getting it widely (and correctly)
>> deployed sooner rather than later, which IMO outweighs the advantages
>> of a more complex approach.

It's actually hard to think of a more unreasonable behaviour than
the one currently specified.

A different, equally simple and magnitudes more useful server behaviour
would be for the server to continue the handshake as normal and simply
assume in the processing of the ClientHello that the Client means
ClientHello.client_version +1 compared to what it sent over the wire.

(but when doing that, the server ought to skip the RSA premaster secret
 client_version check later on when selecting a cipher suite with
 static RSA key exchange.  Since Microsoft botched the RSA premaster
 secret version on renegotiation handshakes in Win7, and there is no
 security value in the check anyway, this should be perfectly OK.)


-Martin