Re: [TLS] Call for acceptance of draft-moeller-tls-downgrade-scsv

On Tue, Jan 28, 2014 at 12:19 PM, Adam Langley <agl@google.com> wrote:
> On Tue, Jan 28, 2014 at 3:12 PM, Andrei Popov
> <Andrei.Popov@microsoft.com> wrote:
>> Correct, but I'm more concerned about this scenario: suppose a client implements a three-stage fallback: TLS1.2-with-extensions ---> TLS1.0-with-extensions ---> SSLv3.
>> Suppose TLS1.2-with-extensions got a RST from a TLS1.2-supporting server because there is an interoperability problem, or a middle box problem, or a configuration problem, etc.
>> The client is now trying TLS1.0-with-extensions + SCSV. Without the SCSV, the handshake may have succeeded, but with SCSV the TLS connection will fail.
>
> We have pretty good evidence that SCSVs are ok from putting them in
> SSLv3 for renego, no?

No, that isn't the concern Mr. Popov expresses. The concern is that
the TLS 1.2 supporting server thinks it supports TLS 1.2 but actually
doesn't. Then the fallback to TLS 1.0 fails, instead of succeeds,
because it's a fallback that is unnecessary according to the server.
He's exactly correct that putting in this SCSV will cause a connection
failure.

However, this can't be distinguished from a downgrade attack, and I
doubt that servers will have mistaken beliefs about their TLS 1.2
support.

>
> I suppose it's possible that there exist some TLSv1 servers that
> handle the renego extension, but couldn't handle the SCSV, but we have
> deployed new ciphersuites in the past without issue, no? (Except for
> the servers that only look at the lower 8-bits, but we believe that we
> can order the ciphersuites to avoid those problems.)
>
>
> Cheers
>
> AGL
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin