Score:1

What does it mean when a request specifies its SSL protocol as 'TLSv1'?

kw flag

I'd like to upgrade my AWS ELBs to a security policy that only allows TLS v1.2.

Before doing this, I wanted to check the ELB logs to ensure that no current customers are using older versions.

My ELB logs have a field 'ssl_protocol'. Most requests log 'TLSv1.2' but a handful specify 'TLSv1'. (There are also a few v1.0 and v1.1 but these all received 4XX responses and so presumably are non-legit traffic).

But I'm not quite sure what to make of this 'TLSv1'. From this question it sounds like a request with a TLSv1 protocol specified is saying it can be encrypted via any TLSv1 minor version, and therefore that if I disallow versions 1.0 and 1.1 these requests would still be successfully encrypted with 1.2.

Is this correct?

Score:1
cn flag

First off, I have not seen any specific information regarding the contents of the ssl_version field in ELB logs, which would be the correct place to authoritatively answer what the ELB logs mean.

That said, in this kind of context the string TLSv1 should reasonably be interpreted to mean TLS version 1.0.
In your particular case, this would imply that those clients do not seem to support higher versions (because they would be expected to prefer and use those whenever possible).

It is worth noting that strings like SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3 especially when written just like this (and sometimes minor variations on the theme, depending on the software involved) are often not free-form text crafted with the exact current context in mind, but rather protocol identifiers used in the underlying software.

As for the potentially confusing TLSv1 identifier widely used for TLS version 1.0, I think what we can read into this is simply that popular implementations (like openssl) were kind of caught out by the change of versioning policy that became clear only when TLS 1.1 and the following versions were introduced much later.
Ie, SSL had been versioned 1.0, 2.0, 3.0, but since the protocol changed names to TLS the versions have instead followed the pattern 1.0, 1.1, 1.2, 1.3. At the time when TLS 1.0 was first introduced, I guess that the assumption simply was that the next version would be 2.0 and that continuing the same pattern of simplified identifiers like before would continue to make sense.

Sidenote:
It is correct that curl has command line options that makes clever use of --tlsv1 meaning something different than --tlsv1.0, but the question is not about how to instruct curl how it is allowed to connect, but rather to parse what a log entry specifies as the exact version a certain connection used.

Score:0
in flag

It's your choice if you want to allow user to fallback to lower version (which off course have vulnerabilities like poodle) or reject if cipher or tls version is not matching. You have to communicate to end user/client from here you have to use mentioned version else connection will be rejected.

So, now if client explicitly says I want to use lower version of TLS but from server you are preventing old version, client will not upgrade version at all. In this case request will be rejected.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.