Subject: [ietf-tls] Re: Re: Re: London

From: [email-masked] (Peter Gutmann)
Date: Tue, 17 Jul 2001 01:52:03 (NZST)

Bodo Moeller <[email-masked]> writes:

>Last I checked (Windows 2000 Professional, IE 5.50.whatever), IE still had SSL
>2.0 support enabled by default, so it used the SSL 2.0 CLIENT-HELLO format.

Ah, sorry, my message wasn't very clear: If you disable SSLv2 (which I always
do), MSIE works as expected but Netscape still sends an SSLv2 handshake.

>If you disabled SSL 2.0 and enabled TLS 1.0 (the latter was disabled by
>default), it did not use the SSL 3.0 ClientHello format as it should have
>done, but the TLS 1.0 ClientHello format; that is, the record header contained
>a 'version' value of {0x03, 0x01}, i.e. the 'client_version' value, while it
>should contain {0x03, 0x00} for backwards compatibility.

That's correct isn't it? RFC 2246 says:

  TLS clients who wish to negotiate with SSL 3.0 servers should send client
  hello messages using the SSL 3.0 record format and client hello structure,
  sending {3, 1} for the version field to note that they support TLS 1.0. If
  the server supports only SSL 3.0, it will respond with an SSL 3.0 server
  hello; if it supports TLS, with a TLS server hello. The negotiation then
  proceeds as appropriate for the negotiated protocol.

(Why is TLS disabled by default in MSIE?  I always enable it at the same time I
 disable SSLv2, and it's never caused me any problems).

Peter.

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]