Ssl – TLS 1.3 Client-/Server-Hello Version 1.2

opensslsslwireshark

I started a TLS1.3-server via openSSL (version 1.1.1-pre4 (beta) 3 Apr 2018
)

$ openssl s_server -key key.pem -cert cert.pem -accept 44330 -www -tls1_3

and a TLS1.3 client

$ openssl s_client -connect 127.0.0.1:44330 -tls1_3

I captured the traffic via wirehark (version: 2.9.0-55):

TLS1_3 Wireshark pcap-data

Why is version 1.2 concerning the handshake protocol and even 1.0 for the record layer detected/defined?

While reading the rfc-draft, I found this:

In order to maximize backwards compatibility, records containing an
initial ClientHello SHOULD have version 0x0301 and a record containing
a second ClientHello or a ServerHello MUST have version 0x0303,
reflecting TLS 1.0 and TLS 1.2 respectively.

Looking at my pcap, this record containing a second ClientHello can not be found. And the following ServerHello is indeed version 0x0303.

But it seems, that client and server do speak TLS1.3 after all:
enter image description here

I do not understand this. Can you help me?

Best Answer

Because poor implementations broke when presented with 1.3.

Cloudflare: Why TLS 1.3 isn't in browsers yet

When presented with a client hello with version 3.4, a large percentage of TLS 1.2-capable servers would disconnect instead of replying with 3.3. Internet scans by Hanno Böck, David Benjamin, SSL Labs, and others confirmed that the failure rate for TLS 1.3 was very high, over 3% in many measurements.

The controversial choice was to accept a proposal from David Benjamin to make the first TLS 1.3 message (the client hello) look like it TLS 1.2. The version number from the client was changed back to (3, 3) and a new “version” extension was introduced with the list of supported versions inside. The server would return a server hello starting with (3, 4) if TLS 1.3 was supported and (3, 3) or earlier otherwise. Draft 16 of TLS 1.3 contained this new and “improved” protocol negotiation logic.

The original protocol negotiation mechanism is unrecoverably burnt. That means it likely can’t be used in a future version of TLS without significant breakage.

Related Topic