3

I have two Client Hello messages from the same client to different servers, my client supports TLS 1.2 and TLS 1.3 as seen in the client hello supported versions.

In the first message the client chooses record layer version TLS 1.3. Client Hello 1 - Wireshark snapshot

While in the second message the client chooses record layer version TLS 1.2. (the client only sent hello and received alert) Client Hello 2 - Wireshark snapshot

Did the client really choose the version? If so, how the client decided the version if he hasn't received the Server Hello message yet.

Or does Wireshark set the version according to what he saw in the server hello?

How can this be explained?

1

2 Answers 2

5

Wireshark sees the ClientHello in context of the following packets. If the handshake results in a common version of TLS 1.2 it will show TLS 1.2 record layer, with TLS 1.3 it will show TLS 1.3 record layer. If one only exports the packets up to the ClientHello it is not possible yet for Wireshark to see which version will be used (since no reply of the server yet) and then Wireshark will even show TLSv1 record layer only, even if this is exact the same ClientHello as before:

enter image description here

6

Or does wireshark sets the version according to what he saw in the server hello?

Yes. That title line is Wireshark's summary of the message. You can see in the detailed content of the message that in both cases:

  • The record protocol version (outside of the ClientHello message) is 0x0301, which is the version number corresponding to TLS 1.0. Already in TLS 1.2, the record layer version for the ClientHello message can be either 0x0303 (TLS 1.2) or 0x0301 (TLS 1.0) for backward compatibility.
  • The message protocol version (inside the ClientHello message) is 0x0303, which is the version number corresponding to TLS 1.2. In TLS 1.0 to 1.2, this is normally the highest protocol version supported in the client, and the server normally replies using the highest version that it supports (without necessarily knowing whether the client supports it, if it's an older version). In TLS 1.3, this field has changed to be for backward compatibility purposes only, and the supported_versions extension is mandatory.
  • In the supported_versions extension, the client indicates that it supports both 0x0303 (TLS 1.2) and 0x0304 (TLS 1.3).

The TLS 1.3 specification explains the reasons for these strange version number indications. It's mostly about backward compatibility, allowing a client to advertise TLS 1.3 support while still being able to contact servers that only support older versions. The backward compatibility constraint isn't just about servers, but also about firewalls and other network equipment that only let traffic through that they recognize as being "good" TLS. Quite a bit of software rejects version numbers that are higher than what they know is "good", which would have blocked TLS 1.3 traffic if TLS 1.3 had used the logical version numbers.

By the way, the reason why the versions look like 3.1 for TLS 1.0, 3.2 for TLS 1.1, 3.3 for TLS 1.2 and 3.4 for TLS 1.3 are similar. TLS 1.0 is SSL v3.1 in all but name, since it only had fairly minor modifications compared to SSL 3.0, and keeping the major version at 1 made backward compatibility easier. TLS 1.3 has so many differences with previous versions that it would have made sense to call it 2.0, but the major version indication inside the protocol had to stay at 1 to avoid being rejected by overly constrained software.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .