[zedred]

> If negotiating TLS 1.2, TLS 1.3 servers MUST set the last eight bytes of their Random value to the bytes: 44 4F 57 4E 47 52 44 01

If it is possible to do this safely, does that mean the TLS 1.2 Random value was always eight bytes too long? Or that it was unnecessary?

[yuhong]

SSLv2-style ClientHellos typically used a 16 byte random. Current ones always use a 32 byte random.