[TLS] When/why is the RSA premaster secret version rollback check needed?

["Brian Smith" <[e-mail]>]

What attack is thwarted by checking the version number in the premaster
secret that isn't thwarted by the Finished message hash & HMAC? If a server
finds this check problematic for some reason, what alternate countermeasures
could it take to achieve a same security assurance? 

 

At first, I thought it was enough to disable SSL 2.0 support. But, the TLS
1.2 specification actually requires *stricter* checks when the hello
versions are newer than it does when the hello versions are older. I am
having trouble understanding how this makes sense.

 

My intuition tells me that for a server that doesn't support SSL 2.0, the
premaster secret version check must either be unnecessary, or it must be
caused by some problem inherent to RSA key exchange that I've overlooked,
since the Finished message protects the entire contents of hello messages
(including the version numbers), and this specific check isn't done for
other key exchange methods.

 

Any help-even simply a link to the discussion that motivated the addition of
the version number into the RSA encrypted premaster secret-would be greatly
appreciated.

 

Thank you,

Brian