Re: [TLS] Comments/Questions on draft-gutmann-tls-encrypt-then-mac-00.txt

[Bodo Moeller <[e-mail]>]

> Instead of particular versions, it seems to me that an indicator of "I
> tried to connect using a higher version than I'm using now but had to
> fall back to this verion" would cover any case now or later.
>

Indeed that's what I ended up writing down for an Internet Draft.

The server would respond with an extension value indicating whether it
> intends to communicate over the channel using the negotiated version or
> not.  (It may be OK with a TLS 1.2 -> TLS 1.1 downgrade, but not to 1.0
> or SSLv3, for example.)  Both sides would continue the handshake through
> completion to ensure that everything is legitimate.
>

If everything *is* legitimate (and the implementations are correct), the
initial handshake with no downgrade should have gone through (and
negotiated the highest common version).  So I think all that's called for
if there's a problem with a downgraded connection is a fatal alert.

Bodo