0

I am testing TLS 1.3 for my application. Can a TLS 1.3 enabled client communicate with a TLS 1.2 enabled server? If yes, what should be the record layer for the initial client hello? Currently, I am seeing TLSv1 record layer for some and Tlsv2 record layer for some interfaces. I see Tlsv1.3 record layer when client and server are both enabled for Tlsv1.3.

1 Answer 1

3

... if TLS 1.3 enabled client can communicate with TLS 1.2 enabled server.

Usually this is the case. But the client might also have disabled TLS 1.2 support, in which client and server don't share a protocol version both support.

If yes, what should be the record layer for the initial client hello?

From the TLS 1.3 standard RFC 8446:

  struct {
      ContentType type;
      ProtocolVersion legacy_record_version;
      uint16 length;
      opaque opaque fragment[TLSPlaintext.length];
  } TLSPlaintext;

legacy_record_version:
MUST be set to 0x0303 for all records generated by a TLS 1.3 implementation other than an initial ClientHello (i.e., one not generated after a HelloRetryRequest), where it MAY also be 0x0301 for compatibility purposes. ...

Thus it will be TLS 1.2 (0x0303) but might be TLS 1.0 (0x0301) in ClientHello.

I see Tlsv1.3 record layer when client and server are both enabled for Tls1.3.

This is not the record layer information but what Wireshark shows as interpretation since it has determined that TLS 1.3 is spoken.

3
  • Thank you! Can I assume the client is trying to communicate using TLS 1.3 as I see the extension supported_versions with TLS 1.3 which is TLS 1.3 specific even though client hello shows as TLS 1.2 or TLS 1.1 for protocol in wireshark?
    – user282171
    Sep 1, 2022 at 10:53
  • @user282171: supported_extensions is exactly where TLS 1.3 shows what protocol versions are supported, i.e. no longer in record layer. Sep 1, 2022 at 12:56
  • @user282171: yes the 'protocol' column in Wireshark message-list pane for ClientHello is probably the record layer version but is not related to the actual protocol version; for everything after a seen ClientHello it is the protocol version but is not the record layer version. Sep 2, 2022 at 3:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .