Subject: Re: [TLS] Record version (was Re: Salsa20 stream cipher in TLS)
From: Wan-Teh Chang <[email-masked]>
To: "Michael D'Errico" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Date: Fri, 22 Mar 2013 10:49:54 -0700
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>

On Fri, Mar 22, 2013 at 10:30 AM, Michael D'Errico <[email-masked]> wrote:
>
> Perhaps some better advice should be added next time ("use the client's
> lowest supported version") and placed in the main document instead of
> an appendix....

As RFC 5246 Appendix E says, this is a complex topic.

We encountered one server that supports SSL 3.0 and TLS 1.0 and
chooses the version in the record layer, ignoring ClientHello.client_version:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/ssl/ssl3con.c&rev=1.207&mark=2379-2386#2379

If you put the lowest version number supported by the client,
which is typically SSL 3.0 {03, 00}, in the record layer, this
server will pick SSL 3.0, even though it can also do TLS 1.0.

In our experience with the Google Chrome browser, putting
TLS 1.0 {03, 01} in the record layer of the initial ClientHello
has worked well. (ClientHello.client_version is TLS 1.1 {03, 02}
for Google Chrome.)

Wan-Teh