tlsnotary/tlsnotary — pull request #86 by AdamISZ (2014-12-11 19:26:08+00:00)
Title: TLS 1.1 enabled

Tested on Linux normal mode/ self test / autotester.

TLS 1.1 preference in tlsnotary.ini ; if preference is set, all audit sessions conducted with TLS 1.1 unless server downgrades to TLS 1.0, which is handled correctly.

Some technical notes:
The encrypted premaster secret first two bytes are the protocol version. This should always be the same as that in the Client Hello, even if the Server Hello requested a downgrade. This works well with TLSNotary's pre-computation of the encrypted pre-master secret.
The main difference between TLS 1.1 and 1.0 is that 1.1 uses a per-record IV; this is implemented as a single AES block of random bytes (using os.urandom(aes_block_size)). This is an additional field prepended to the content in the Application Data message.