Re: [TLS] checking on an scsv point

[Martin Thomson <[e-mail]>]

On 18 February 2015 at 11:28, Martin Rex <[e-mail]> wrote:
> You mean that this client will fallback further _down_, rather than
> upwards as the server suggests?

Indeed.  I expect that to be a common response.

> I assume this is mostly because the App does the heuristics here
> and has little information to do its heuristics (it probably doesn't
> have the ServerHello to look at).  But that should be an easy
> fix to the app heuristics.

I'm largely talking about apps that don't change here, because if they
were to change, then I'd be arguing for disabling fallback.  It's
actually fairly easy to make the change, because the app is usually
well aware of the fact that it is performing a fallback when it does.
What is needed is a signal to the TLS stack that it should accept a
higher version in the ServerHello.