[gnutls-devel] GnuTLS | handshake: defer setting downgrade sentinel until version is selected (!918)
Development of GNU's TLS library
gnutls-devel at lists.gnutls.org
Fri Feb 15 19:17:26 CET 2019
Hubert Kario commented on a discussion on lib/handshake.c:
> _gnutls_handshake_log("HSK[%p]: Selected version %s\n", session, session->security_parameters.pversion->name);
> + /* set downgrade sentinel if the server supports TLS 1.3 and
one that does a TLS 1.2 resumption and then verifies that the sentinel was set? no
but it's very simple to do, it requires doing a regular resumption test and only providing one more option to `ExpectServerHello` the `server_max_protocol=` with `(3, 4)` as parameter: [test-downgrade-protection.py](https://github.com/tomato42/tlsfuzzer/blob/13479e5a44bc10e3577fc28b921c5b999a363ce9/scripts/test-downgrade-protection.py#L149-L178)
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/merge_requests/918#note_141836000
You're receiving this email because of your account on gitlab.com.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Gnutls-devel