Re: [TLS] SCSVs and SSLv3 fallback

[[e-mail] (Martin Rex)]

Yngve N. Pettersen wrote:
> Martin Rex <[e-mail]> wrote:
> >
> > Quoting from rfc4346 (TLS v1.1 Record Protocol PDU):
> >
> >        http://tools.ietf.org/html/rfc4346#page-18
> >
> >        struct {
> >            uint8 major, minor;
> >        } ProtocolVersion;
> >
> >        struct {
> >            ContentType type;
> >            ProtocolVersion version;
> >            uint16 length;
> >            opaque fragment[TLSPlaintext.length];
> >        } TLSPlaintext;
> 
> The version field is defined as (major, minor), the version negotiation  
> logic (See RFC 5246 Sec E.1) is defined as lowest version of the clients  
> signaled version and the highest supported by the server. There is AFAIK  
> nothing in RFC 5246 that says that the major version must match, at least  
> implying that the operation is min((major_client, minor_client),  
> (major_server, minor_server)).

I'm sorry, but that is a non-seqitur.

from the conceivable version numbers:

   {1.x}    undefined
   {2,x}    undefined (reserved/blocked)
   {3,x}    SSLv3 and TLS
   {4,x}    undefined
   {127,x}  undefined
   {128,x}  undefined
   {129,x}  undefined
   {253,x}  undefined
   {254,x}  DTLS
   {255,x}  undefined


and only the behaviour for {3,x} for x>3 is covered in rfc5246 Appendix E.


> 
> I think is is quite reasonable to assume that *if* TLS should ever need a  
> significant upgrade, one large enough that the major version number is  
> changed,

This is silly and unnecessary.

The IETF could easily assign the marketing term "TLSv2.0"
for ProtocolVersion {3,4}, so there is no reason to use a major version
other than 3 for the forseeable future.

-Martin