Subject: [ietf-tls] Re: Re: London

From: Eric Rescorla <[email-masked]>
Date: 16 Jul 2001 08:23:58 -0700

Bodo Moeller <[email-masked]> writes:

> On Mon, Jul 16, 2001 at 07:59:08AM -0700, Eric Rescorla wrote:
> > The client is supposed to use value 2 in the PMS. I would expect
> > the server to compare it against either value 2 (correctly) or
> > value 3 (incorrectly). In either case, I don't see why the contents
> > of the client_hello record header should cause a problem for this
> > comparison.
> 
> Some servers (including all version of SSLeay with SSL 3.0 support and
> OpenSSL before release 0.9.5) use the version number from the
> ClientHello's record header when they should have used the
> client_version value appearing in the actual message.  If the former
> is lower than the latter, the server will negotiate the wrong version,
> which breaks the handshake in the case of ciphersuites with
> RSA-encrypted premaster secrets.
I see. Interesting bug. 

I thought you were talking about a different PMS-related bug--using
the negotiated version instead of the client's offered version
for the PMS version. This bug can happen even if the record
version number and the client_version are the same.

> > On the other hand, the server might check value 1 against his
> > highest supported version and send an alert prior to sending the
> > server hello.
> 
> Exactly; this is why clients probably should use the lower version
> number in the record header.  (But servers shouldn't really insist on
> any particular minor version number in the record headers -- there
> does not appear to be any advantage in looking at this value.)
I agree.

-Ekr

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]