Re: [TLS] Deprecating SSLv3

[Manuel Pégourié-Gonnard <[e-mail]>]

On 11/11/2014 00:17, Martin Thomson wrote:
> https://datatracker.ietf.org/doc/draft-thomson-sslv3-diediedie/
> 
Thanks for your work on this! I'm very sympathetic to the goal, but I'm a bit
puzzled by the following statement:

                                                   Clients MUST NOT set
   a record layer version number (TLSPlaintext.version) of {03,00}.
   Clients SHOULD offer their highest supported version (that is, the
   same value that appears in ClientHello.client_version); though
   clients MAY use any value greater than or equal to the lowest version
   number they are willing to negotiate.  Servers SHOULD accept
   handshakes from clients that propose SSLv3 or higher, but MUST NOT
   negotiate SSLv3.

The underlying assumption between the first sentence seems to be that
TLSPlaintext.version somehow indicates the lowest version that the client is
willing to negotiate. The last sentence also seems to imply the server knows the
range of versions the client is willing to use (as opposed to just the highest
version), which seems to confirm that.

Is there already something in the standard that says that the client offers a
range of versions by using TLSPlaintext.version for the lower bound in addition
to ClientHello.client_version? I didn't find it, so I'm worried about
(implicitly) introducing new semantics about version negotiation in this document.

Also, I'm curious about the reason why clients SHOULD "offer" the same version
in TLSPlaintext.version as in ClientHello.client_version: first, I'm not sure
what purpose it serves. Second and more importantly, isn't there a risk of
introducing new intolerance issues? This is an actual question, if you have the
answer and it's no, I'm delighted.

Manuel.