Michael D'Errico wrote:
> 
> Based on the scenarios below, it looks like Opera is doing the right
> thing during the renegotiation while IE 8 is not.

Opera is sending the correct client_version in the RSA PreMaster Secret
in both handshakes (initial and renegotiation).  Handshakes in the
originial SSLv3 and TLS protocol were completely independent and
self-contained, so the back-reference of the client_version in
RSA premaster secret is ALWAYS to the ClientHello handshake message
of the current handshake.

But both browsers should actually be sending their highest supported
protocol version as client_version on EVERY ClientHello handshake
message--independent of whether they propose session resumption--
and both browsers appear to flunk on this point.


-Martin

> 
> Xuelei Fan wrote:
> > In RFC4346/5246, the specification for client_version in the
> > PreMasterSecret is described as:
> > ---------------
> >       struct {
> >           ProtocolVersion client_version;
> >           opaque random[46];
> >       } PreMasterSecret;
> > 
> >       client_version The latest (newest) version supported by the
> >          client.  This is used to detect version roll-back attacks.
> >          Upon receiving the premaster secret, the server SHOULD check
> >          that this value matches the value transmitted by the client in
> >          the client hello message.
> > 
> >       ....
> > 
> >    Note: The version number in the PreMasterSecret MUST be the version
> >          offered by the client in the ClientHello, not the version
> >          negotiated for the connection.  This feature is designed to
> >          prevent rollback attacks.
> > ---------------
> > 
> > The spec is clear for initial handshaking. But while testing
> > renegotiation, we get two different interpretations of the version
> > number in the PreMasterSecret. We noticed Opera (10.50) uses the version
> > number offered by the renegotiation ClientHello, while Microsoft IE 8
> > (IE 8 at Windows 7) uses the version number offered by the ClientHello
> > in the initial handshaking.
> > 
> > For Opera, the scenario looks like:
> > 
> >     Opera <--------------> TLS server
> >          --->ClientHello V1.2--->
> >          <---ServerHello V1.1<---
> >          ...
> >          --->PreMasterSecret (v1.2)--->  (as expected)
> >          ...
> >          <---HelloRequest<----
> >          ---->ClientHello v1.1----> (ask for an abbreviated handshake)
> >          <---ServerHello V1.1<---   (not resumable, new session)
> >          ...
> >          --->PreMasterSecret (v1.1)---> (*)
> > 
> > 
> > For IE 8, the scenario looks like:
> > 
> >     IE 8<--------------> TLS server
> >          --->ClientHello V1.2--->
> >          <---ServerHello V1.1<---
> >          ...
> >          --->PreMasterSecret (v1.2)--->  (as expected)
> >          ...
> >          <---HelloRequest<----
> >          ---->ClientHello v1.1----> (ask for an abbreviated handshake)
> >          <---ServerHello V1.1<---   (not resumable, new session)
> >          ...
> >          --->PreMasterSecret (v1.2)---> (**)
> > 
> > (*) Opera uses the version number offered by the ClientHello in the
> > renegotiation handshaking.
> > (**) IE 8 uses the version number offered by the ClientHello in the
> > initial handshaking.
> > 
> > Please help to clarify what's the correct version number choice for
> > renegotiation.
> > 
> > Thanks,
> > Xuelei (Andrew) Fan
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>