search

project-everest / mitls-fstar

Verified implementation of TLS 1.3 in F*
https://www.mitls.org
Other
173 stars 16 forks source link

miTLS server rejects a retried ClientHello which seems to be legal #184

Closed oweisse-msft closed 6 years ago

oweisse-msft commented 7 years ago

OpenSSL client sends ClientHello, with KeyShare not supported by the miTLS client: image

miTLS server replies with HelloRetry: image

OpenSSL client replies with an amended ClientHello: image

miTLS server emits an "illegal_parameter alert. The debug output says: "TLS| sendAlert AD_illegal_parameter (Inconsistant parameters between first and second client hello)".

While the ClientHello contains less extensions than before, it seems to conform to the requirements in section 4.1.4 of the RFC (draft 21).

ad-l commented 7 years ago

The new ClientHello sent by OpenSSL does not comply with the rules in 4.1.2: the client MUST send the same ClientHello (without modification) except for key_share, early_data, cookie, pre_shared_key In that case extensions from the original CH are removed in the second one

ad-l commented 6 years ago

Fixed in OpenSSL master