The scenario of Figure 1

[kazu-yamamoto]

I'm confused with the scenario of Figure 1:

Client                                          Server

   Chosen = A, Other Versions = (A, B) ----------------->
   <------------------------ Version Negotiation = (D, C)

   Chosen = C, Other Versions = (C, D) ----------------->
   <----------------- Chosen = D, Other Versions = (D, C)

The client chose C from VN.

When Other Versions is validated, the rule is:

The Other
Versions field is validated by confirming that the client would have
attempted the same version with knowledge of the versions the server
supports. That is, the client would have selected the same version
if it received a Version Negotiation packet that listed the versions
in the server's Other Versions field, plus the negotiated version.

So, this validation fails since the client would choose C.

[DavidSchinazi]

In both cases, the client chose C. Attempted means "chose", not "negotiated".

[kazu-yamamoto]

OK. So, the client checks the followings to prevent downgrade attack, right?

• Check Other Versions so that the virtual second choice is the same as the first choice. (C in this case).
• Check if Chosen is the same as the negotiated version after handshake. (D in this case).

[DavidSchinazi]

That's correct

[kazu-yamamoto]

Thanks. Now it's clear to me.