Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

[Florian Weimer <[e-mail]>]

On 10/15/2014 06:08 PM, Salz, Rich wrote:
>> SCSV implementation would make things worse for Firefox users because it
>> results in a reliable connection failure instead of a downgrade from TLS
>> 1.1 to TLS 1.2.
>
> Yes, exactly.  If a browser is going to fallback, it could ask the user "I'm going to retry, and you'll lose PFS; if the server is ever cracked by the NSA all your data will be readable.  Proceed?" If the usre clicks yes, then the browser tries again with the fallback SCSV.   (I would hope that the user-agent would provide more understable message, but I'm not optimistic.)
>
> The point kis that a transient network error has highly visible security implications.
>
> HTTP doesn't auto-retry, either.

I was trying to point out that HTTPS in Firefox actually did retry, in 
many cases successfully, and now it doesn't (attempts to retry will fail 
consistently).  That smells like a regression in the making.

-- 
Florian Weimer / Red Hat Product Security