Subject: [TLS] DTLS 1.2 HelloVerifyRequest version numbers

From: Jack Lloyd <[email-masked]>
Date: Wed, 15 Aug 2012 17:40:56 -0400

I'm having a hard time reconciling these statements in RFC 6347 (all
in section 4.2.1):

(a) "[...] DTLS 1.2 server implementations SHOULD use DTLS version 1.0
[in the HelloVerifyRequest] regardless of the version of TLS that is
expected to be negotiated."

(b) "In particular, DTLS 1.2 clients MUST NOT assume that because the
server uses version 1.0 in the HelloVerifyRequest that the server is
not DTLS 1.2 or that it will eventually negotiate DTLS 1.0 rather than
DTLS 1.2."

(c) "The server MUST use the same version number in the
HelloVerifyRequest that it would use when sending a ServerHello.  Upon
receipt of the ServerHello, the client MUST verify that the server
version values match."

Statement (a) says servers should send server_version=1.0 in the
HelloVerifyRequest even if they and the client both support DTLS 1.2,
(b) seems to be saying that a client seeing a HelloVerifyRequest with
server_version=1.0 should not assume the server will eventually
negotiate 1.0, and (c) seems to say that the client must, after having
seen a 1.0 HelloVerifyRequest, reject a ServerHello with version != 1.0

How, then, is it expected for a DTLS 1.2 connection to be negotiated?
The only out I see here is servers ignoring the SHOULD of (a) and
sending DTLS 1.2 in the HelloVerifyRequest if that is what it would
have negotiated from the client hello. And the MUSTs of (b) and (c)
seem to directly contradict each other, so I have to wonder if the
check in (c) is something accidentally carried over from the 1.0 spec.

Regards,
  Jack