15 Aug 2012 23:40
DTLS 1.2 HelloVerifyRequest version numbers
Jack Lloyd <lloyd <at> randombit.net>
2012-08-15 21:40:56 GMT
2012-08-15 21:40:56 GMT
I'm having a hard time reconciling these statements in RFC 6347 (all in section 4.2.1): (a) "[...] DTLS 1.2 server implementations SHOULD use DTLS version 1.0 [in the HelloVerifyRequest] regardless of the version of TLS that is expected to be negotiated." (b) "In particular, DTLS 1.2 clients MUST NOT assume that because the server uses version 1.0 in the HelloVerifyRequest that the server is not DTLS 1.2 or that it will eventually negotiate DTLS 1.0 rather than DTLS 1.2." (c) "The server MUST use the same version number in the HelloVerifyRequest that it would use when sending a ServerHello. Upon receipt of the ServerHello, the client MUST verify that the server version values match." Statement (a) says servers should send server_version=1.0 in the HelloVerifyRequest even if they and the client both support DTLS 1.2, (b) seems to be saying that a client seeing a HelloVerifyRequest with server_version=1.0 should not assume the server will eventually negotiate 1.0, and (c) seems to say that the client must, after having seen a 1.0 HelloVerifyRequest, reject a ServerHello with version != 1.0 How, then, is it expected for a DTLS 1.2 connection to be negotiated? The only out I see here is servers ignoring the SHOULD of (a) and sending DTLS 1.2 in the HelloVerifyRequest if that is what it would have negotiated from the client hello. And the MUSTs of (b) and (c) seem to directly contradict each other, so I have to wonder if the check in (c) is something accidentally carried over from the 1.0 spec. Regards, Jack
RSS Feed