Re: [TLS] What's the right version number in the PreMasterSecret for renegotiation

Kyle Hamilton wrote:
> Can you please explain how and why you came to this conclusion?  (Please 
> don't take offense, I'm not disputing the conclusion, I simply wish to 
> be more informed as to why?)

The problematic handshake is:

        ---->ClientHello v1.1----> (ask for an abbreviated handshake)
        <---ServerHello V1.1<---   (not resumable, new session)
        ...
        --->PreMasterSecret (v1.2)---> (**)

The version encoded within the PreMasterSecret is not the version
that was used in the ClientHello.  That's a violation of the spec.

The fact that the client does actually support version 1.2 is
immaterial.  A server is not expected to have logic that keeps track
of the highest version the client has ever offered in the past.

Mike

> On Mon, Aug 9, 2010 at 8:20 PM, Michael D'Errico <mike-list@pobox.com> 
> wrote:
>> Based on the scenarios below, it looks like Opera is doing the right
>> thing during the renegotiation while IE 8 is not.
>>
>> Mike
>>
>>
>>
>> Xuelei Fan wrote:
>>>
>>> In RFC4346/5246, the specification for client_version in the
>>> PreMasterSecret is described as:
>>> ---------------
>>>      struct {
>>>          ProtocolVersion client_version;
>>>          opaque random[46];
>>>      } PreMasterSecret;
>>>
>>>      client_version The latest (newest) version supported by the
>>>         client.  This is used to detect version roll-back attacks.
>>>         Upon receiving the premaster secret, the server SHOULD check
>>>         that this value matches the value transmitted by the client in
>>>         the client hello message.
>>>
>>>      ....
>>>
>>>   Note: The version number in the PreMasterSecret MUST be the version
>>>         offered by the client in the ClientHello, not the version
>>>         negotiated for the connection.  This feature is designed to
>>>         prevent rollback attacks.
>>> ---------------
>>>
>>> The spec is clear for initial handshaking. But while testing
>>> renegotiation, we get two different interpretations of the version
>>> number in the PreMasterSecret. We noticed Opera (10.50) uses the version
>>> number offered by the renegotiation ClientHello, while Microsoft IE 8
>>> (IE 8 at Windows 7) uses the version number offered by the ClientHello
>>> in the initial handshaking.
>>>
>>> For Opera, the scenario looks like:
>>>
>>>    Opera <--------------> TLS server
>>>         --->ClientHello V1.2--->
>>>         <---ServerHello V1.1<---
>>>         ...
>>>         --->PreMasterSecret (v1.2)--->  (as expected)
>>>         ...
>>>         <---HelloRequest<----
>>>         ---->ClientHello v1.1----> (ask for an abbreviated handshake)
>>>         <---ServerHello V1.1<---   (not resumable, new session)
>>>         ...
>>>         --->PreMasterSecret (v1.1)---> (*)
>>>
>>>
>>> For IE 8, the scenario looks like:
>>>
>>>    IE 8<--------------> TLS server
>>>         --->ClientHello V1.2--->
>>>         <---ServerHello V1.1<---
>>>         ...
>>>         --->PreMasterSecret (v1.2)--->  (as expected)
>>>         ...
>>>         <---HelloRequest<----
>>>         ---->ClientHello v1.1----> (ask for an abbreviated handshake)
>>>         <---ServerHello V1.1<---   (not resumable, new session)
>>>         ...
>>>         --->PreMasterSecret (v1.2)---> (**)
>>>
>>> (*) Opera uses the version number offered by the ClientHello in the
>>> renegotiation handshaking.
>>> (**) IE 8 uses the version number offered by the ClientHello in the
>>> initial handshaking.
>>>
>>> Please help to clarify what's the correct version number choice for
>>> renegotiation.
>>>
>>> Thanks,
>>> Xuelei (Andrew) Fan
>>
>> _______________________________________________
>> TLS mailing list
>> TLS@ietf.org
>> https://www.ietf.org/mailman/listinfo/tls
>>
> 