Strength of TLS handshake I asked this question recently but I was told it is not save to simply send over the identifier for your crypto method you want to use. for example, say the server has crypto method 3 5 and 6, the client had 2, 3, and 6.

The clients sends the methods it can do and the server checks the highest possible version. A man in the middle could intercept the message from the client and only send 3, so the server would use the weakest common method. Obviously you don't want this, we want them to use 6 (the highest is the strongest in this case).

I have tried to figure out why TLS does not have this weakness (other than the FREAK bug) but somehow I can't find out why TLS does this better. So my question: How does TLS ensure the use of the best crypto method both the server and client share?



Background info

I curently have a piece of code which has a crypto layer (very old) it currently sends 00 which indicates it needs to use our old crypto method but 01 will be TLS (which I'm going to implement) However having TLS and an insecure exchange to determine the crypto method is obviously as strong as our insecure exchange. But to keep it backwards compatible we can't simply switch our old crypto method for TLS so we need to do this exchange. which is why i need to know how to do this properly.
How does TLS ensure the use of the best crypto method both the server and client share?


It does not. The server is responsible for selecting the cipher and there is no guarantee that it will select the best. But, if a man-in-the-middle tampers with the ClientHello to change the ciphers offered to the server, then this tampering will be detected at the end of the handshake, because their is a final signature over all data of the handshake and this signature will not match anymore.