Subject: [ietf-tls] Re: Re: London

From: Bodo Moeller <[email-masked]>
Date: Mon, 16 Jul 2001 17:06:28 +0200

On Mon, Jul 16, 2001 at 07:59:08AM -0700, Eric Rescorla wrote:

[...]
>>>> With ClientHellos built like this, IE avoided the bug in servers that
>>>> use 'version' where they should use 'client_version' -- in those
>>>> ClientHellos, these two were the same value, after all.

>>> As I understood it, the client_version/version problem was about
>>> checking in the PMS decryption process. Is there any server which
>>> is confused about version checking in the record layer?

>> I'm not sure I understand this question.  If a server uses 'version'
>> instead of 'client_version' for premaster secret decryption
>> verification and the values odiffer, then the handshake quite simply
>> will fail.

> There are a number of values to consider
> (1) The version number in the record header of the client_hello
> (2) The version number in the client_hello message (the client_version)
> (3) The negotiated version (in the server_hello)
> (4) The version number in the record header of server_hello
> and subsequent messages.
> (5) The version number in the PMS.
> 
> The client is supposed to use value 2 in the PMS. I would expect
> the server to compare it against either value 2 (correctly) or
> value 3 (incorrectly). In either case, I don't see why the contents
> of the client_hello record header should cause a problem for this
> comparison.

Some servers (including all version of SSLeay with SSL 3.0 support and
OpenSSL before release 0.9.5) use the version number from the
ClientHello's record header when they should have used the
client_version value appearing in the actual message.  If the former
is lower than the latter, the server will negotiate the wrong version,
which breaks the handshake in the case of ciphersuites with
RSA-encrypted premaster secrets.

> On the other hand, the server might check value 1 against his
> highest supported version and send an alert prior to sending the
> server hello.

Exactly; this is why clients probably should use the lower version
number in the record header.  (But servers shouldn't really insist on
any particular minor version number in the record headers -- there
does not appear to be any advantage in looking at this value.)

-- 
Bodo Möller <[email-masked]>
PGP http://www.informatik.tu-darmstadt.de/TI/Mitarbeiter/moeller/0x36d2c658.html
* TU Darmstadt, Theoretische Informatik, Alexanderstr. 10, D-64283 Darmstadt
* Tel. +49-6151-16-6628, Fax +49-6151-16-6036

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]