Re: [TLS] DTLS HelloVerifyRequest.server_version

[Nikos Mavrogiannopoulos <[e-mail]>]

On Mon, 2014-07-21 at 19:17 +0200, Manuel Pégourié-Gonnard wrote:
> Hi,
> 
> Sorry if I'm just being dense and fail to understand something very
> obvious, but I have trouble understanding how the server_version field
> of HelloVerifyRequest should be handled, according to section 4.2.1 of
> RFC 6347.
> 
> More precisely, I'm under the impression that the last paragraph of page
> 15 and the first of page 16 contain contradictory statements:
>                       DTLS 1.2 server implementations SHOULD use DTLS
>    version 1.0 regardless of the version of TLS that is expected to be
>    negotiated.

If I remember well the reason for that is that the HelloVerifyRequest is
sent without any state being considered. That is, it is very likely that
the server does not know the protocol that will actually be negotiated
in the handshake (remember that HelloVerifyRequest is sent in a
stateless way to prevent DoS on the server).

>                                           The server MUST use the same
>    version number in the HelloVerifyRequest that it would use when
>    sending a ServerHello.

I'd fill an errata for that, the text as you notice looks inconsistent.

regards,
Nikos