[TLS] [Fwd: Re: What's the right version number in the PreMasterSecret for renegotiation]

[Michael D'Errico <[e-mail]>]

Nasko asked that I forward this message to the list.  Apologies
if you've already received it.

Mike

--- Begin Message ---

On Fri, Apr 20, 2012 at 11:42:47AM -0700, Michael D'Errico wrote:
> While it would be good for clients to do this correctly, I've seen
> many people argue that checking the version embedded inside an RSA
> premaster secret serves no purpose other than to cause more failed
> handshakes.  Version rollback protection is redundant since the
> Finished messages also catch tampering.

I'm with Michael on this. I've discussed this privately with a few
people few months ago and the consensus seems to be that from security
perspective it is not needed anymore with one caveat - no SSLv2 fallback
allowed.

The premaster version check was added to prevent the downgrade to SSLv2,
so if SSLv2 is disabled, there is very little use of the value in current
TLS implementations.
 
> So, yes, please fix any problems you find w.r.t. encoding the version
> in the RSA premaster secret, but also consider turning off checking
> in your servers (or make it configurable, disabled by default).

It is best to be configurable, with the default off.

--
Nasko Oskov
"A hacker does for love what others would not do for money."

--- End Message ---