Subject: Re: [TLS] [Cfrg] Salsa20 stream cipher in TLS
From: Adam Langley <[email-masked]>
To: Yoav Nir <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Thu, 21 Mar 2013 08:18:11 -0400
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>

On Thu, Mar 21, 2013 at 8:09 AM, Yoav Nir <[email-masked]> wrote:
> Actually, we turned on TLS 1.2 by default for the speed advantage. iOS begins a TLS handshake with version 1.2, both in ClientHello and in the record layer. Only when the (shocked and flabbergasted) server closes the connection, does the iPhone try with something more sane like 1.0, and then even caches this for a short while.

But you don't need to switch on TLS 1.2 to fix this, right? The server
just needs to implement version negotiation correctly.

(On the flip side, this /is/ a problem for clients since the
incentives are aligned for clients to stop trying TLS 1.2 since they
can't (directly) fix the server.)

Cheers

AGL