Subject: [TLS] Protocol Version Alert Wording

From: Michael D'Errico <[email-masked]>
Date: Tue, 22 Jun 2010 11:12:31 -0700

The language in RFC 5246 for the protocol_version alert is possibly the
cause of the recently noticed behavior of a few high-profile HTTPS servers
that abort any handshake where the client asks for TLS versions 1.1 or 1.2:

    protocol_version
       The protocol version the client has attempted to negotiate is
       recognized but not supported.  (For example, old protocol versions
       might be avoided for security reasons.)  This message is always
       fatal.

This text seems to suggest that if you recognize TLS version 1.2, but do
not implement that version, then you are justified in sending an alert,
which MUST be fatal.

Clearly that is wrong since the spec. later says:

    server_version
       This field will contain the lower of that suggested by the client
       in the client hello and the highest supported by the server....

A suggestion for better text for the protocol_version alert could be:

    protocol_version
       The protocol version the client has attempted to negotiate is
       lower than the minimum version supported by the server.  (Old
       protocol versions might be avoided for security reasons.)  This
       message is always fatal.

Mike