Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

[Manuel Pégourié-Gonnard <[e-mail]>]

On 16/10/2014 12:06, Florian Weimer wrote:
> Interesting things will start to happen once there is TLS 1.3. 
> TLS_FALLBACK_SCSV could really complicate its deployment.
> 
I'm afraid I don't understand which interesting things you're referring to.
Could you please elaborate on that?

I can think of the following scenarios (assuming the client supports 1.3 and
FALLBACK_SCSV):

1. The server also supports 1.3, and no middleware is blocking it -> all good.

2. The server also supports 1.3, but some middleware/attacker is blocking it.
The client retries with 1.2+FALLBACK_SCSV.
	2a. The server also supports FALLBACK_SCSV. The MitM downgrade is avoided.
That's a feature.
	2b. The server doesn't support FALLBACK_SCSV. The MitM downgrade succeeds. Too bad.

3. The server doesn't support 1.3 but is version-tolerant (and so is all
middleware in path). 1.2 is negotiated using the intended mechanism -> all good.

4. The server doesn't support 1.3 but it (or some middleware/attacker) is
1.3-version intolerant. The client retries with 1.2+FALLBACK_SCSV. Regardless of
whether the server supports FALLBACK_SCSV, the handshake succeeds because 1.2 is
indeed the highest version supported by the server. (Assuming it's 1.2 for the
sake of simplicity, but it should work the same way for lower versions.)

What am I missing?

Manuel.