Subject: [TLS] PR#943: Anti-downgrade for TLS 1.0

From: Eric Rescorla <[email-masked]>
Date: Mon, 17 Apr 2017 09:46:38 -0400

https://github.com/tlswg/tls13-spec/pull/948
Target merge date: Tuesday

In Nikos's last call comments, he pointed out that we don't have any
anti-downgrade
for TLS 1.3/2. -> TLS 1.0. That's probably not optimal, so I've updated the
text to use
the same sentinel for TLS 1.0 as TLS 1.1. This won't let you detect
downgrade from
TLS 1.1 to TLS 1.0, but that seems like it's something we can live with as
we want
people to use 1.3 or failing that 1.2.

-Ekr