Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-6976121

TLS client should not use the negotiated protocol version for session resumption

    Details

    • Subcomponent:
    • CPU:
      generic, sparc
    • OS:
      generic, solaris_10

      Description

      TLS specification (RFC 5246) requires that no matter initial handshake or session resumption, ClientHello.client_version SHOULD be the latest version supported by the client:

         client_version
            The version of the TLS protocol by which the client wishes to
            communicate during this session. This SHOULD be the latest
            (highest valued) version supported by the client. For this
            version of the specification, the version will be 3.3 (see
            Appendix E for details about backward compatibility).

      However, for abbreviated handshake(session resumption), SunJSSE use the negotiated protocol version. Need to evaluate the interoperability and necessities about whether we should switch to use the latest version supported in abbreviated handshakes.

      See: http://www.ietf.org/mail-archive/web/tls/current/msg06842.html

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                xuelei Xue-Lei Fan
                Reporter:
                xuelei Xue-Lei Fan
              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:
                  Imported:
                  Indexed: