Subject: Re: [TLS] supported_versions question

From: Brian Smith <[email-masked]>
Date: Mon, 7 Nov 2016 12:02:34 -1000

Kurt Roeckx <[email-masked]> wrote:

> So I guess you're also saying that a server that implements TLS
> 1.1 to TLS 1.3, but disables TLS 1.2 and TLS 1.3 support should
> ignore the supported_versions even when it knows about it?
>
> I guess I have same questions but with only TLS 1.3 disabled, to
> be sure when we need to look at it.

>From the perspective of the application developer, if I've disabled TLS 1.3
then I'd rather not  have any TLS 1.3 behavior implemented; I'd rather have
the implementation behave the same as before it supported TLS 1.2,
more-or-less. That means in particular that supported_versions should be
ignored if TLS 1.3 and later have been disabled. Put another way, if TLS
1.2 is the maximum version the application has enabled, then the TLS 1.3
specification in total is irrelevant and only RFC 5246 (and perhaps
earlier) apply, and those specifications don't specify supported_versions.

Consider in particular that an application might want to disable (or avoid
enabling) TLS 1.3 to avoid some problem (perhaps a security problem) with
supported_versions processing. It would be bad to not have any way of
disabling supported_versions processing, and it doesn't seem good from a
usability standpoint to have a separate nob to control it.

Cheers,
Brian
-- 
https://briansmith.org/

---

From: Hubert Kario <[email-masked]>
Date: Tue, 15 Nov 2016 12:53:15 +0100

On Monday, 31 October 2016 20:19:15 CET Dave Garrett wrote:
> On Monday, October 31, 2016 08:05:59 pm Matt Caswell wrote:
> > On 31/10/16 23:53, Dave Garrett wrote:
> > >> I came up with some alternative wording that I think captures the
> > >> discussion:
> > >> 
> > >> https://github.com/tlswg/tls13-spec/pull/748
> > > 
> > > I see no reason to require servers to validate the legacy version value.
> > > That's just excess complexity. If the extension is there, then it
> > > should take absolute precedence. If not, use the old system. Nothing
> > > will have a higher value there except old probers.> 
> > If legacy_version == 0x0302 (TLS1.1), but highest supported_version is
> > 0x0303 (TLS1.2) - or vice versa, which client_version should be used
> > in an RSA key exchange calculation?
> 
> Why would this ever happen? What client is offering to support TLS 1.1 via
> the ClientHello field but offers only TLS 1.2 via the TLS 1.3 extension?
> This is a very contrived implementation error; if you need to account for
> it, abort the connection with an error. As to the vice versa, dropping
> 1.0/1.1 support from the extension avoids that.

could be a result of fallback dance

And I think it should be treated the same way signature_algorithms are - 
inapplicable to TLS1.1 and lower - thus ignore completely

-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic