[TLS] Client Hello version during renegotiation.

Fabrice Gautier <fabrice.gautier@gmail.com> Tue, 26 March 2013 23:29 UTC

MIME-Version: 1.0
From: Fabrice Gautier <fabrice.gautier@gmail.com>
Date: Tue, 26 Mar 2013 16:21:50 -0700
Message-ID: <CANOyrg_5SosECvhruzzRY6MXigV6VmW9+nMQWE9QGX0xKLeZsg@mail.gmail.com>
To: tls@ietf.org
Content-Type: text/plain; charset="ISO-8859-1"
Subject: [TLS] Client Hello version during renegotiation.
Precedence: list

Hi all,

If I'm reading the RFC 5746 correctly, a TLS 1.2 client that initially
negotiated a TLS 1.0 connection with a server should subsequently set
their ClientHello.version to TLS 1.0 in any subsequent renegotiation.

Also, when generating the premaster secret in the RSA key exchange,
the client should use the protocol version sent in its
ClientHello.version, although using the negotiated version may be
acceptable.


As it turns out, it looks like Exchange 2010 servers are not paying
nice with this.

Those servers do not support TLS 1.2 and will downgrade to 1.0.
They will properly accept the 1.2 version in the premaster secret
during the initial handshake.
But when the client send a TLS 1.0 client hello during a
renegotiation, the handshake will fail if a TLS 1.0 version is used in
the premaster secret.
It will succeed if a TLS 1.2 version is used in the premaster secret
during the renegotiation.

On the other hand, using a TLS 1.2 version in the premaster secret,
while sending a TLS 1.0 client hello will break openssl and gnutls
servers.

It looks like this is worked around in OpenSSL (1.0.1) by sending a
TLS 1.2 client hello during the renegotiation, even if the server
indicated that they only supported 1.0.

Gnutls clients (3.0.8) will fail as explained above.


So two questions:
- Is gnutls doing the right thing and Exchange just buggy ?
- Is the OpenSSL workaround a sane thing to do ?


Relevant OpenSSL ChangeLog:

 Changes between 1.0.0h and 1.0.1  [14 Mar 2012]
[...]
  *) Some servers which support TLS 1.0 can choke if we initially indicate
     support for TLS 1.2 and later renegotiate using TLS 1.0 in the RSA
     encrypted premaster secret. As a workaround use the maximum pemitted
     client version in client hello, this should keep such servers happy
     and still work with previous versions of OpenSSL.
     [Steve Henson]



-- Fabrice

[TLS] Client Hello version during renegotiation. Fabrice Gautier
Re: [TLS] Client Hello version during renegotiati… Ryan Sleevi
Re: [TLS] Client Hello version during renegotiati… Martin Rex
Re: [TLS] Client Hello version during renegotiati… Fabrice Gautier
Re: [TLS] Client Hello version during renegotiati… Martin Rex