Re: [TLS] Comments/Questions on draft-gutmann-tls-encrypt-then-mac-00.txt

[Yoav Nir <[e-mail]>]

On Sep 26, 2013, at 7:27 AM, Peter Gutmann <[e-mail]> wrote:

> Michael D'Errico <[e-mail]> writes:
> 
>> Instead of particular versions, it seems to me that an indicator of "I
>> tried to connect using a higher version than I'm using now but had to
>> fall back to this verion" would cover any case now or later.
> 
> That seems more intuitively useful from the server admin's point of view,
> you could use it to gather traffic stats on forced fallbacks, detect
> middleboxes, and so on.  It'd also allow you to make informed decisions
> on how far you want to fall back, for example you could use it to 
> determine that only 0.5% of users are having to fall back to SSLv3 and 
> therefore refuse to connect below TLS 1.0.

That kind of statistics collection would work if clients did something like this:
 - Try with TLS 1.2 with extensions... failed
 - Try with TLS 1.1 with extensions... failed
 - Try with TLS 1.0 with extensions... failed
 - Try with TLS 1.0 without extensions... failed
 - Try with SSLv3

But browser makers are very much concerned about connection time. So the sequence is going to be TLS 1.0 (with 1.2 in the ClientHello) with extensions, and then straight down to SSLv3 (or TLS 1.0 without extensions if SSLv3 is disabled).

So if something blocks TLS 1.1 or 1.2, you're going to get the percentage of clients that have SSLv3 enabled (and are behind some meddling middlebox)

Yoav