Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

[Bodo Moeller <[e-mail]>]

Andrei Popov <[e-mail]>:


> Regardless of what the browser wants to do, the system admin will
> sometimes disable a specific TLS version machine-wide (or enterprise-wide),
> e.g. due to version-specific security concerns.


That's not supported with normal TLS version negotiation either -- if the
client offers version X, the server may pick Y (< X) without having any way
of knowing that Y is disabled in the client whereas some other version Z (<
Y) is not.

If you really see a good reason to support this (which I don't) and are
concerned about latency, you'd already need some TLS extension to send this
information from the client to the server. I've never seen anyone propose
this, and would be skeptical about it.

I am pointing out that, with the current draft, the browser is forced to
> not send the SCSV when skipping versions.


I'd rather say that the client is forced not to skip versions when sending
the SCSV (and that this is a feature).

Bodo