Re: [TLS] Comments/Questions on draft-gutmann-tls-encrypt-then-mac-00.txt

[Mohamad Badra <[e-mail]>]

On Thu, Sep 26, 2013 at 12:54 AM, Martin Rex <[e-mail]> wrote:
> Bodo Moeller wrote:
>> > Instead of particular versions, it seems to me that an indicator of "I
>> >> tried to connect using a higher version than I'm using now but had to
>> >> fall back to this verion" would cover any case now or later.
>> >>
>> >
>> > Indeed that's what I ended up writing down for an Internet Draft.
>> >
>>
>> Now here:
>>
>> http://www.ietf.org/internet-drafts/draft-bmoeller-tls-downgrade-scsv-00.txt
>
> OH NO, not again!!
>
> Any kind of specification for TLS, that suggests to the server
> to apply heuristics and make (often flawed or unjustified) assumptions
> about what the client may want or may not want and have the _server_
> abort the handshake rather than the client, are a REALLY BAD IDEA and
> squarely against the IETF spirit to promote interop.
>
> Fatal SSL alerts in particular, are worst of all, because they do often
> do not give any clue, are not ever sent by a number of TLS implementations
> (you just see the connection close/reset), and are hardly/poorly visualized
> or not even accessible on many TLS clients.
>
> If anything, then such a "downgrade protection discovery" signaling
> cihper suites should cause the server to respond with a ServerHelloExtension
> listing the features that the server supports and would be capable
> of processing properly when present in ClientHello, and leave the
> decision, whether to abort the handshake and whether to tell or ask
> the user about any perceived problems first, entirely up to the client.
>
>
> -Martin

[reference] http://www.ietf.org/mail-archive/web/tls/current/msg08892.html