2

I sent a client hello indicating TLS1.3 support, and it contains a list of all ciphersuites that support TLS1.3, TLS1.2 and TLS1.1

And consider server negotiated TLS1.3 indicating serverHello.supported_versions=0304, but ciphersuite selected as part of serverHello is the one compatible with TLS1.2 (i.e; not a ciphersuite mentioned in below list)

TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_128_CCM_SHA256
TLS_AES_128_CCM_8_SHA256

In Appendix B.4. Cipher Suites from RFC8446 it's mentioned

"Although TLS 1.3 uses the same cipher suite space as previous versions of TLS, TLS 1.3 cipher suites are defined differently, only specifying the symmetric ciphers, and cannot be used for TLS 1.2. Similarly, cipher suites for TLS 1.2 and lower cannot be used with TLS 1.3."

This line clearly states if the server negotiates with TLS1.3, it can't have a TLS1.2 ciphersuite.

If the server did negotiate with supported_version = 0304(TLS1.3) and TLS1.2 ciphersuite, then how is the client supposed to respond if the serverHello message is to be rejected, then with what Alert?

1 Answer 1

4

You basically describe a behavior where the server violates the standard, i.e. using a TLS 1.2 cipher with TLS 1.3. Common reaction to non-standard behavior of the server is to simply close the connection and throw an error on the client side.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .