Re: [TLS] What's the right version number in the PreMasterSecret for renegotiation

["Kyle Hamilton" <[e-mail]>]

Can you please explain how and why you came to this conclusion?  (Please don't take offense, I'm not disputing the conclusion, I simply wish to be more informed as to why?)

-Kyle H

On Mon, Aug 9, 2010 at 8:20 PM, Michael D'Errico <[e-mail]> wrote:
> Based on the scenarios below, it looks like Opera is doing the right
> thing during the renegotiation while IE 8 is not.
>
> Mike
>
>
>
> Xuelei Fan wrote:
>>
>> In RFC4346/5246, the specification for client_version in the
>> PreMasterSecret is described as:
>> ---------------
>>      struct {
>>          ProtocolVersion client_version;
>>          opaque random[46];
>>      } PreMasterSecret;
>>
>>      client_version The latest (newest) version supported by the
>>         client.  This is used to detect version roll-back attacks.
>>         Upon receiving the premaster secret, the server SHOULD check
>>         that this value matches the value transmitted by the client in
>>         the client hello message.
>>
>>      ....
>>
>>   Note: The version number in the PreMasterSecret MUST be the version
>>         offered by the client in the ClientHello, not the version
>>         negotiated for the connection.  This feature is designed to
>>         prevent rollback attacks.
>> ---------------
>>
>> The spec is clear for initial handshaking. But while testing
>> renegotiation, we get two different interpretations of the version
>> number in the PreMasterSecret. We noticed Opera (10.50) uses the version
>> number offered by the renegotiation ClientHello, while Microsoft IE 8
>> (IE 8 at Windows 7) uses the version number offered by the ClientHello
>> in the initial handshaking.
>>
>> For Opera, the scenario looks like:
>>
>>    Opera <--------------> TLS server
>>         --->ClientHello V1.2--->
>>         <---ServerHello V1.1<---
>>         ...
>>         --->PreMasterSecret (v1.2)--->  (as expected)
>>         ...
>>         <---HelloRequest<----
>>         ---->ClientHello v1.1----> (ask for an abbreviated handshake)
>>         <---ServerHello V1.1<---   (not resumable, new session)
>>         ...
>>         --->PreMasterSecret (v1.1)---> (*)
>>
>>
>> For IE 8, the scenario looks like:
>>
>>    IE 8<--------------> TLS server
>>         --->ClientHello V1.2--->
>>         <---ServerHello V1.1<---
>>         ...
>>         --->PreMasterSecret (v1.2)--->  (as expected)
>>         ...
>>         <---HelloRequest<----
>>         ---->ClientHello v1.1----> (ask for an abbreviated handshake)
>>         <---ServerHello V1.1<---   (not resumable, new session)
>>         ...
>>         --->PreMasterSecret (v1.2)---> (**)
>>
>> (*) Opera uses the version number offered by the ClientHello in the
>> renegotiation handshaking.
>> (**) IE 8 uses the version number offered by the ClientHello in the
>> initial handshaking.
>>
>> Please help to clarify what's the correct version number choice for
>> renegotiation.
>>
>> Thanks,
>> Xuelei (Andrew) Fan
>
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls
>