Re: [TLS] Interaction between session resumption and negotiated protocol version

[David Benjamin <[e-mail]>]

On Fri, Apr 3, 2015 at 7:33 PM Dave Garrett <[e-mail]> wrote:

> TLS 1.2 has:
>
> Whenever a client already knows the highest protocol version known to
> a server (for example, when resuming a session), it SHOULD initiate
> the connection in that native protocol.
>
> TLS 1.3 currently has:
>
> A client resuming a session SHOULD initiate the connection using the
> version that was previously negotiated.
>

That new version is also unwise and the entire text just be dropped. It
means you get stuck at that version even if the server gets upgraded later.

It also tends to compound itself with other problems. Maybe you implement a
version fallback, but fail to shard the session cache by fallback type (you
really really should do that if you have a fallback). Now any spurious
callback is sticky and there's no way to get back to the original version
unless the session expires on the client. (Expiring on the server doesn't
help you any. The damage is done before ServerHello.)

I cannot stress enough how much pain and suffering that one little sentence
can cause. :-) I ended up completely redoing the version negotiation logic
in BoringSSL because of how far OpenSSL takes that advice on the client and
how much it breaks.

David