Re: [TLS] RI, TLS Extension tolerance and version tolerance in servers

[Martin Rex <[e-mail]>]

Yngve N. Pettersen wrote:
> 
> With such a re-iteration a separate requirement could be stated for
> clients: When sending the RI Extension they MUST identify the highest
> SSL/TLS protocol version they support, and it is a fatal error (no
> fallback permitted) if the server refuses to negotiate such a Hello, since
> such a refusal must be considered an attempt to perform a version rollback
> attack.

If you really wanted to retrofit a version rollback attack into the
installed base along with secure TLS renegotiation, then I would
suggest to piggy-back the information about the highest supported
protocol version of the server into the (currently empty)
TLS extension Server->Client on the initial handshake.

The client (like your favorite browser) can then decide whether it
cares and how it cares about not having negotiated a protocol
version that it believes to be preferable (you indicated to
have fallback re-connect logic, so your browser could even
automatically retry instead of nagging the user).

-Martin