[TLS] Open issue: Record Version Numbers

[Eric Rescorla <ekr@xxxxxxxxxxxxxxxxxxxx>]

Yngve Petterson has pointed out [0] that there is some confusion
in how to interpret what version numbers ought to appear in
the ClientHello record in TLS handshakes. The issue is that
there are two numbers:

- the record version number
- the client hello version number

The text is quite clear that the second of these should be the
highest version you support. However, the text for the secodn
reads:

   "TLS clients who wish
   to negotiate with SSL 3.0 servers should send client hello messages
   using the SSL 3.0 record format and client hello structure, sending
   {3, 1} for the version field to note that they support TLS 1.0".	

I read this text as saying that if you are a client who supports TLS 1.0
and SSLv3, you should in general send the following values:

- record version number           {3, 0} (SSLv3)
- client hello version number     {3, 1} (TLSv1)

If the server decides to accept TLS 1.0, it should respond with the
following values:

- record version number           {3, 1} (TLSv1)
- client hello version number     {3, 1} (TLSv1)

Pettersen reports that in some cases this causes errors because servers
(inexplicably) use the record version in the negotiation.  However, I
think at the end of the day, that's a clear implementation error
and the spec should just clarify that the above behavior is what's
expected.

Comments?

-Ekr


[0] draft-ietf-pettersen-tls-interop-experience-00 (soon to
    be a TLS-WG draft but not published that way yet).



_______________________________________________
TLS mailing list
TLS@xxxxxxxxxxxxxx
https://www1.ietf.org/mailman/listinfo/tls