Re: [TLS] Supported Versions extension

2016-10-17 Thread Brian Smith
Eric Rescorla wrote: > Brian Smith wrote: > >> Ilari Liusvaara wrote: >> >>> Omitting TLS 1.2 causes failures in some downnegotiation cases (when >>> there >>> are higher versions supported, but not overlapping). >>> >> >> Could you provide a concrete example, please? >> > > When I support TLS

Re: [TLS] Supported Versions extension

2016-10-17 Thread Eric Rescorla
On Mon, Oct 17, 2016 at 4:40 PM, Brian Smith wrote: > Ilari Liusvaara wrote: > >> Omitting TLS 1.2 causes failures in some downnegotiation cases (when there >> are higher versions supported, but not overlapping). >> > > Could you provide a concrete example, please? > When I support TLS 1.2 and

Re: [TLS] Supported Versions extension

2016-10-17 Thread Brian Smith
Ilari Liusvaara wrote: > Omitting TLS 1.2 causes failures in some downnegotiation cases (when there > are higher versions supported, but not overlapping). > Could you provide a concrete example, please? Thanks, Brian -- https://briansmith.org/ ___ TLS

Re: [TLS] Supported Versions extension

2016-10-17 Thread Ilari Liusvaara
On Mon, Oct 17, 2016 at 10:25:07AM -1000, Brian Smith wrote: > Hubert Kario wrote: > > > Currently the description of the extension states that only TLS versions > > can > > be listed in the extension and all unknown versions must be ignored. > > > > I wonder if making it explicit that {3, 0} and

Re: [TLS] Supported Versions extension

2016-10-17 Thread Brian Smith
Hubert Kario wrote: > Currently the description of the extension states that only TLS versions > can > be listed in the extension and all unknown versions must be ignored. > > I wonder if making it explicit that {3, 0} and any lower values MUST NOT be > advertised wouldn't be a good idea, if only

[TLS] Supported Versions extension

2016-10-17 Thread Hubert Kario
Currently the description of the extension states that only TLS versions can be listed in the extension and all unknown versions must be ignored. I wonder if making it explicit that {3, 0} and any lower values MUST NOT be advertised wouldn't be a good idea, if only to hammer it that SSL3 must no