Re: [TLS] An SCSV to stop TLS fallback.

[[e-mail] (Martin Rex)]

Watson Ladd wrote:
[ Charset UTF-8 unsupported, converting... ]
> To clarify.
> >
> > Btw. AES128-CBC-SHA1 is more secure than AES128-GCM/-CCM, so the only
> > thing the client might be "loosing" is a little performance, and
> > that AEAD can not currently be negotiated and used unless
> > ClientHello.client_version is set to { 0x03, 0x03 } is a silly defect
> > of the specification(s) that could be easily fixed.
>
> I am assuming you are discussing the modes as specified and
> implemented in TLS? In that case you are dead wrong.
> Lucky 13, BEAST, and even if we drop all that no protocol depending
> both on SHA1 and AES can be stronger than one depending
> on AES alone.

Lucky 13 and BEAST are completely irrelevant for the majority
of usage scenarios, and there's even a simple 1/(n-1) record splitting
workaround for BEAST for those with paranoia.

I don't know what you mean by "AES alone", but if you are refering
to "AES-GCM", that isn't AES alone, but AES in combination with GHASH,
and HMAC-SHA1 beats the security of GHASH by a huge safety margin.

-Martin