Re: [TLS] An SCSV to stop TLS fallback.

[[e-mail] (Martin Rex)]

Adam Langley wrote:
[ Charset UTF-8 unsupported, converting... ]
> On Mon, Nov 25, 2013 at 9:19 PM, Martin Rex <[e-mail]> wrote:
> > If there is a problem in negotiating what _we_want_to_do_, because the
> > installed base does not like the kind of negotiation that was originally
> > proposed to be used, then the pragmatic engineering approach will be
> > to define an alternative negotiation of at least a useful subset
> > that will be compatible with the installed base, and which will not need
> > to be stripped from a "conservative fallback handshake" -- and therefore
> > will be resilient to downgrade attacks, and cope with retarded middle boxes.
> 
> Backporting AES-GCM, ECDHE, etc all the way back to SSLv3 is a
> possibility if it comes to it.

Strictly speaking, there is no need to backport anything, if this
was implemented as an alternative fashion to negotiate the use
of TLSv1.2 protocol PDUs&semantics.

ECDHE is already allowed with TLSv1.0 and TLSv1.1, so the only thing that
is missing is permitting AES-GCM (i.e. the GenericAEADCipher PDU)
with TLSv1.0&TLSv1.1 -- which is an extremely trivial and straightforward
change -- half of the work is removing lines of the kind
  "if ( tls_version<TLS_VERSION_12 ) { goto abort_handshake; }"
in the code that implements the TLS record layer.


>
> However, it's a lot more work than the
> anti-fallback mechanisms currently under consideration so I'd want to
> exclude them first.

No, it should be negligible.  For a reasonably structured implementation
of TLSv1.2, it should be less changes than rfc5746 (renego)


> 
> I know know of a reason to believe that they would have less
> compatibility problems than an SCSV.

You're trying to mitigate the risks of reconnect fallbacks in clients,
and perpetuate the reconnect fallbacks, where as the correct fix is to
obviate the reconnect fallbacks.  Making AES-GCM and ECDHE more
backwards-interop friendly will also allow clients that do not
implement reconnect fallbacks, to use these features (=a reasonable
subset of them).


-Martin