Subject: [ietf-tls] Re: Re: London

From: Eric Rescorla <[email-masked]>
Date: 16 Jul 2001 07:16:42 -0700

Bodo Moeller <[email-masked]> writes:
> Last I checked (Windows 2000 Professional, IE 5.50.whatever), IE still
> had SSL 2.0 support enabled by default, so it used the SSL 2.0
> CLIENT-HELLO format.  If you disabled SSL 2.0 and enabled TLS 1.0 (the
> latter was disabled by default), it did not use the SSL 3.0
> ClientHello format as it should have done, but the TLS 1.0 ClientHello
> format; that is, the record header contained a 'version' value of
> {0x03, 0x01}, i.e. the 'client_version' value, while it should contain
> {0x03, 0x00} for backwards compatibility.
This sounds like the correct behavior to me.

> With ClientHellos built like this, IE avoided the bug in servers that
> use 'version' where they should use 'client_version' -- in those
> ClientHellos, these two were the same value, after all.
As I understood it, the client_version/version problem was about
checking in the PMS decryption process. Is there any server which
is confused about version checking in the record layer?

-Ekr

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]