IETF Logo Mail Archive

Re: [TLS] Renego Indication RI patch interaction with TLS major version interop

Peter Gutmann <pgut001@cs.auckland.ac.nz> Thu, 17 June 2010 06:58 UTC

Return-Path: <pgut001@cs.auckland.ac.nz>
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2FF2C3A6967 for <tls@core3.amsl.com>; Wed, 16 Jun 2010 23:58:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.885
X-Spam-Level:
X-Spam-Status: No, score=-1.885 tagged_above=-999 required=5 tests=[AWL=0.714, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F9tvO46Ue6TL for <tls@core3.amsl.com>; Wed, 16 Jun 2010 23:58:02 -0700 (PDT)
Received: from mx2-int.auckland.ac.nz (mx2-int.auckland.ac.nz [130.216.12.41]) by core3.amsl.com (Postfix) with ESMTP id F10723A6A0C for <TLS@ietf.org>; Wed, 16 Jun 2010 23:57:58 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=pgut001@cs.auckland.ac.nz; q=dns/txt; s=uoa; t=1276757888; x=1308293888; h=from:to:subject:cc:in-reply-to:message-id:date; z=From:=20Peter=20Gutmann=20<pgut001@cs.auckland.ac.nz> |To:=20agl@google.com,=20simon@josefsson.org,=20yngve@ope ra.com|Subject:=20Re:=20[TLS]=20Renego=20Indication=20RI =20patch=20interaction=20with=20TLS=20major=20version=20i nterop|Cc:=20TLS@ietf.org|In-Reply-To:=20<op.vec8hyzoqrq7 tp@acorna.invalid.invalid>|Message-Id:=20<E1OP935-0002ku- 9U@wintermute02.cs.auckland.ac.nz>|Date:=20Thu,=2017=20Ju n=202010=2018:58:03=20+1200; bh=LyLS7blTnXATVGqkO1lLGPsXcbHWrehyyEIzNZZOhj4=; b=H0yslDOkiAm4uCF3hAobAAX5vq7pdp9YjLMK7vTSGJKS+cPwaGW54Ww7 V3g4+GNeJCC/AYqWy6WDHejcsNiVGqMRzgnOq4T+jx+a+Q4waNZTFG+SG qQFnPSnuVinSQ8km1zXRcY3VtSIyuTpxO/X/qxQakGOijTBnnuZx2sftM 4=;
X-IronPort-AV: E=Sophos;i="4.53,430,1272801600"; d="scan'208";a="11539919"
X-Ironport-HAT: UNIVERSITY - $RELAY-THROTTLE
X-Ironport-Source: 130.216.207.92 - Outgoing - Outgoing
Received: from wintermute02.cs.auckland.ac.nz ([130.216.207.92]) by mx2-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 17 Jun 2010 18:58:04 +1200
Received: from pgut001 by wintermute02.cs.auckland.ac.nz with local (Exim 4.69) (envelope-from <pgut001@cs.auckland.ac.nz>) id 1OP935-0002ku-9U; Thu, 17 Jun 2010 18:58:03 +1200
From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: agl@google.com, simon@josefsson.org, yngve@opera.com
In-Reply-To: <op.vec8hyzoqrq7tp@acorna.invalid.invalid>
Message-Id: <E1OP935-0002ku-9U@wintermute02.cs.auckland.ac.nz>
Date: Thu, 17 Jun 2010 18:58:03 +1200
Cc: TLS@ietf.org
Subject: Re: [TLS] Renego Indication RI patch interaction with TLS major version interop
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Jun 2010 06:58:03 -0000

"Yngve N. Pettersen (Developer Opera Software ASA)" <yngve@opera.com> writes:

>   - 0.4% require RSA CKE version field to match negotiated version

This is because of a bug in MSIE, but the logic for checking for the bug is a
bit convoluted:

	/* Older versions of MSIE send the wrong version number for the premaster
	   secret (making it look like a rollback attack) so if we're expecting
	   3.1 from the client and get 3.0 in the premaster secret then it's MSIE
	   screwing up.  Note that this bug-check is only applied for SSL and TLS
	   1.0, for TLS 1.1 and later the check of the version is mandatory */

Presumably you're checking for 3.1 vs. 3.0, thereby triggering the MSIE bug-
workaround.

Peter.

v2.23.0 | Report a Bug | By Email