Re: [TLS] Fallback SCSV summary

[Bodo Moeller <[e-mail]>]

> > So ... unless I'm misunderstanding what you describe here, these servers
> > plainly don't tolerate new (= unknown, to them) cipher suites in the
> list?!
> > Interesting.
>


> There's a suggestion that some implementations only look at the second
> byte.


Oh, that. Good point. Obviously, these servers will have other problems too
(just due to collisions between deployed cipher suites in the Standards
Action range and the Specification Required space), and failing the entire
handshake if one of the cipher suites supposedly suggested by the client
seems suspect is broken too, but right, that kind of issue may explain why
more servers reject our concrete SCSV value than other potential SCSV
values.  (It's not clear that you'd even *want* to interoperate with such
servers ... keeping them around would make it harder to add new actual
cipher suites.)


>   A legacy of SSLv2, I believe.
>

Actually, SSL 2 cipher suites ("cipher kinds") had three bytes.  It's
probably simply a legacy of all SSL 3.0 cipher suites having the common
first byte 0x00.

Bodo