Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

[Florian Weimer <[e-mail]>]

On 10/15/2014 08:24 PM, Martin Thomson wrote:
> On 15 October 2014 11:09, Bodo Moeller <[e-mail]> wrote:
>> Preventing such attacks, of course, is what we consider a feature. Google
>> servers support the SCSV, and so does the Chrome browser; so we have the
>> required real-life experience indicating that deploying the SCSV is
>> practical.
>
> And I'd like to add that the SCSV has been in Firefox Nightly for a
> while now.  We got some early reports of problems because of the way
> we were reacting to spurious fallbacks, but that has been addressed
> and I've not seen any subsequent reports of problems.

Interesting things will start to happen once there is TLS 1.3. 
TLS_FALLBACK_SCSV could really complicate its deployment.

> This is a strictly good feature for Firefox users.  The alternative
> (disable insecure version intolerant fallback entirely) is completely
> untenable for us.

Why do you think that?  Is this observation based on data tainted by the 
spurious downgrade bugs you had?  Do you know if the downgrades are due 
to server problems or interception by law enforcement?  (I suspect the 
latter would magically go away if you got rid of the fallback code.)

I just find it difficult to reconcile your decision to keep the fallback 
with the announcement to disable SSL 3.0 by default.  Surely the latter 
change is going to bite many users.  (I'm aware that fallback can still 
happen from one TLS version to another, that's not what puzzles me.)

-- 
Florian Weimer / Red Hat Product Security