Re: [TLS] interop for TLS clients proposing TLSv1.1

[Martin Rex <[e-mail]>]

Yngve N. Pettersen wrote:
> 
> On Mon, 26 Sep 2011 16:27:41 +0200, Martin Rex <[e-mail]> wrote:
> > 
> > It seems that no TLS client that propose TLSv1.1 or higher today
> > would want to do so without a reconnect fallback facility in place.
> > The problem of the reconnect fallback is, that it precludes a protected
> > negotiation of the TLS version.
> 
> As long as there is no way to tell if a server is negotiating version  
> correctly, then we do need a fallback mechanism.
> 
> It is, however, a mechanism that for HTTPS, at least, is becoming less  
> needed, as I indicated earlier in this thread.
> 
> I also think we have a mechanism now that can be used as an indicator that  
> the server can negotiate version in the required fashion, without needing  
> a fallback system: The Renegotiation Indication Extension.
> 
> The Renego specification contain a reminder about version and extension  
> tolerance being required. (Yes, I lobbied for the inclusion of that  
> particular text).

I know that this was the original plan.

But these nice plans were foiled when Microsoft shipped their
implementation of rfc5746 with KB980436.

In retrospect, we ought to have required in rfc5746 to entirely
disable the version checking for the RSA premaster secret on the
Server side...


-Martin