Subject: Re: [TLS] What's the right version number in the PreMasterSecret for renegotiation

From: Andrei Popov <[email-masked]>
Date: Fri, 20 Apr 2012 17:20:34 +0000

Coming back to this thread, we are investigating the possible interoperability and RFC compliance issues in Microsoft's SSL/TLS implementation.

Thanks for bringing this to our attention,

Andrei Popov,
Microsoft

On Tue, 10 Aug 2010 at 16:02:42 -0700, Michael D'Errico <[email-masked]> wrote:
> The problematic handshake is:
>
>        ---->ClientHello v1.1----> (ask for an abbreviated handshake)
>        <---ServerHello V1.1<---   (not resumable, new session)
>        ...
>        --->PreMasterSecret (v1.2)---> (**)
>
> The version encoded within the PreMasterSecret is not the version
> that was used in the ClientHello.  That's a violation of the spec.
>
> The fact that the client does actually support version 1.2 is
> immaterial.  A server is not expected to have logic that keeps track
> of the highest version the client has ever offered in the past.

---

From: Michael D'Errico <[email-masked]>
Date: Fri, 20 Apr 2012 11:42:47 -0700

While it would be good for clients to do this correctly, I've seen
many people argue that checking the version embedded inside an RSA
premaster secret serves no purpose other than to cause more failed
handshakes.  Version rollback protection is redundant since the
Finished messages also catch tampering.

So, yes, please fix any problems you find w.r.t. encoding the version
in the RSA premaster secret, but also consider turning off checking
in your servers (or make it configurable, disabled by default).

Mike