MIME-Version: 1.0
In-Reply-To: <514C9538.7030401@pobox.com>
References: <20130322052312.1ADD51A65B@ld9781.wdf.sap.corp>
 <514C9538.7030401@pobox.com>
Date: Fri, 22 Mar 2013 10:49:54 -0700
Message-ID: <CALTJjxEV_zYJ9_igbAR9ynRGdbXhmwBux552NAAgSdbJ6_3-bA@mail.gmail.com>
From: Wan-Teh Chang <wtc@google.com>
To: "Michael D'Errico" <mike-list@pobox.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Record version (was Re: Salsa20 stream cipher in TLS)
Precedence: list

On Fri, Mar 22, 2013 at 10:30 AM, Michael D'Errico <mike-list@pobox.com> wrote:
>
> Perhaps some better advice should be added next time ("use the client's
> lowest supported version") and placed in the main document instead of
> an appendix....

As RFC 5246 Appendix E says, this is a complex topic.

We encountered one server that supports SSL 3.0 and TLS 1.0 and
chooses the version in the record layer, ignoring ClientHello.client_version:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/ssl/ssl3con.c&rev=1.207&mark=2379-2386#2379

If you put the lowest version number supported by the client,
which is typically SSL 3.0 {03, 00}, in the record layer, this
server will pick SSL 3.0, even though it can also do TLS 1.0.

In our experience with the Google Chrome browser, putting
TLS 1.0 {03, 01} in the record layer of the initial ClientHello
has worked well. (ClientHello.client_version is TLS 1.1 {03, 02}
for Google Chrome.)

Wan-Teh