1

TLS 1.3 has a bit different handshake messages than 1.2 (and older) had. The client is supposed to send DH parameters directly in the first Client Hello message. How do browsers know if that's what they should do? What if the server supports 1.2 tops and it doesn't talk 1.3?

Improve this question
2
  • 3
    The protocol is backwards compatible, i.e. the server ignores the stuff it does not understand and continues with TLS 1.2
    – Steffen Ullrich
    Commented Apr 12, 2022 at 11:01
  • 1
    @mnj The browser is the client and so it acts first. If it wants to use TLS 1.3 it puts 0x0304 in the "supported_versions" extension and it puts 0x0303 in the legacy_version field. See my answer for more details.
    – hft
    Commented Apr 12, 2022 at 20:34

2 Answers 2

Reset to default
5

The browser is the client, and so it acts first.

If the client wants to use TLS 1.3 it will send a ClientHello with the "legacy_version" set to 0x0303 (which means TLS 1.2 not TLS 1.3) and a "supported_versions" extension with 0x0304 (which means TLS 1.3) indicated as the highest supported version.

This is described in RFC 8446, Section 4.1.2. Here is an excerpt from that section:

TLS 1.3 ClientHellos are identified as having a legacy_version of 0x0303 and a supported_versions extension present with 0x0304 as the highest version indicated therein. (See Appendix D for details about backward compatibility.)

See also, this excerpt from RFC 8446 Appendix D.1 "Negotiating with an Older Server" (emphasis added):

A TLS 1.3 client who wishes to negotiate with servers that do not support TLS 1.3 will send a normal TLS 1.3 ClientHello containing 0x0303 (TLS 1.2) in ClientHello.legacy_version but with the correct version(s) in the "supported_versions" extension. If the server does not support TLS 1.3, it will respond with a ServerHello containing an older version number. If the client agrees to use this version, the negotiation will proceed as appropriate for the negotiated protocol.

Improve this answer
4

TLS 1.3 is indeed backwards compatible to TLS 1.2 and below. If a client were to initiate a TLS 1.3 handshake, the server supporting only up to 1.2 would understand some of the ClientHello - enough to reply that it only supports 1.2 (and possibly below).

The ServerHello would then indicate this lower version. The client can then decide whether to downgrade to 1.2 or abort the handshake.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .