0

Is it possible to verify specific TLS or SSL version on application code level ? Is it possible to restrict the application to use only specific TLS or SSL version ?

Consider a scenario, the web server supports TLS 1.0, 1.1, and 1.2. The mobile application (either android or iOS) is build with newer API/SDK that supports TLS 1.2 as well. In theory, TLS context will fall back to the lower one in any cases of negotiation exceptions. So, is there any possible way to validate in the application code that it should only use TLS 1.2 and should not accept lower versions.

I saw some discussion here SSL context can be verified in android. Android TLS connection and self signed certificate. But will the OS override this if any fallback happens at server side ?

Community
  • 1
  • 1
s4n7h0
  • 123
  • 2
  • 7
  • Yes you can configure your SSL/TLS client to only connect with TLS 1.2 or newer. Specific details depend on the client you're using. – laalto Jan 22 '16 at 13:29

1 Answers1

1

If both the server and the client support TLS 1.2, then only TLS 1.2 will be negotiated by correctly implemeted TLS/SSL stacks. They are required to negotiate the highest mutually supported version of the protocol, not the lowest.

To your question on how to restrict which protocol versions to accept/negotiate, it depends on the network library you're using. For example, on Android if you're using SSLSocket instances directly you can set enabled protocols on each SSLSocket instance. If you're using an HTTP library, then it might offer an option of being parameterized with an SSLSocketFactory, where you can provide your own SSLSocketFactory which wraps the default SSLSocketFactory, obtains SSLSocket instances, sets the set of enabled protocols on them, and returns these customized SSLSocket instances to the HTTP stack.

Beware that some HTTP stacks (e.g., okhttp) implement their own TLS protocol fallback logic which does not detect TLS protocol downgrades by Man-in-The-Middle. Such behavior facilitated POODLE vulnerability.

Alex Klyubin
  • 5,554
  • 2
  • 29
  • 24