IETF Logo Mail Archive

Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

Martin Thomson <martin.thomson@gmail.com> Wed, 15 October 2014 18:24 UTC

Return-Path: <martin.thomson@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8566D1A1AFA for <tls@ietfa.amsl.com>; Wed, 15 Oct 2014 11:24:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qGBvaijFSlmL for <tls@ietfa.amsl.com>; Wed, 15 Oct 2014 11:24:15 -0700 (PDT)
Received: from mail-la0-x233.google.com (mail-la0-x233.google.com [IPv6:2a00:1450:4010:c03::233]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E116C1A90A3 for <tls@ietf.org>; Wed, 15 Oct 2014 11:24:14 -0700 (PDT)
Received: by mail-la0-f51.google.com with SMTP id ge10so1556873lab.38 for <tls@ietf.org>; Wed, 15 Oct 2014 11:24:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=wXMn/G7W1sEuEWM7kjcE8RwUH/eRorBS5mmkzI6QKRw=; b=gbW4RIYPFeC0dJ0r/iiTvHzpbJNX1VWM853a2BdYACqmny2sHuD6/1D1dvWpXhsK3W xxNeUPjXdp7zFlJNFKiVGk9yd8QUcJV0jOpHNXxB5gMsMOTBJpml8k7csWjx7eHPUUXa NTPQMMAiK45oTPyqRm5CaQJZJe5WdDT2TwQaeioFxHMulwwcN7gLztltryxfOOrUEogP xBie4US4Dx+QDdk00iceuzJ0sd8zc58zo8WX9EGPbE2hQj0VmOFj4bekPjmlILt7Z5rV ebTVP3MLPWCAcu9SF6JYKr5fTPFx1EdRdfP/DsQn0pxmEe/v3nXtsX03C03dyk1xa1k7 av4A==
MIME-Version: 1.0
X-Received: by 10.112.94.133 with SMTP id dc5mr14162334lbb.11.1413397452974; Wed, 15 Oct 2014 11:24:12 -0700 (PDT)
Received: by 10.25.215.217 with HTTP; Wed, 15 Oct 2014 11:24:12 -0700 (PDT)
In-Reply-To: <CADMpkcLnOh3HGD+urWuo6fPfkX4WfGhwckE0jg5jS2KqD2RuMQ@mail.gmail.com>
References: <2112FCAD-4820-49D9-9871-6501C83A554D@cisco.com> <5438CFEA.7000401@brainhub.org> <543E9435.8000905@redhat.com> <2A0EFB9C05D0164E98F19BB0AF3708C71D39ECE9C9@USMBX1.msg.corp.akamai.com> <543E9C9F.5050104@redhat.com> <2A0EFB9C05D0164E98F19BB0AF3708C71D39ECE9D5@USMBX1.msg.corp.akamai.com> <543E9FFA.5030102@redhat.com> <CADMpkcLnOh3HGD+urWuo6fPfkX4WfGhwckE0jg5jS2KqD2RuMQ@mail.gmail.com>
Date: Wed, 15 Oct 2014 11:24:12 -0700
Message-ID: <CABkgnnWuCwOGBXG2RdetwPFn4KtVPygSBWG5qkme1mvNst6n+A@mail.gmail.com>
From: Martin Thomson <martin.thomson@gmail.com>
To: Bodo Moeller <bmoeller@acm.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/5Cl0Uk6VCovel4yq7FnZePTsl-g
Cc: Florian Weimer <fweimer@redhat.com>, "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 15 Oct 2014 18:24:16 -0000

On 15 October 2014 11:09, Bodo Moeller <bmoeller@acm.org> wrote:
> Preventing such attacks, of course, is what we consider a feature. Google
> servers support the SCSV, and so does the Chrome browser; so we have the
> required real-life experience indicating that deploying the SCSV is
> practical.

And I'd like to add that the SCSV has been in Firefox Nightly for a
while now.  We got some early reports of problems because of the way
we were reacting to spurious fallbacks, but that has been addressed
and I've not seen any subsequent reports of problems.

This is a strictly good feature for Firefox users.  The alternative
(disable insecure version intolerant fallback entirely) is completely
untenable for us.  If you personally don't like that, I've a patch
that allows users to disable fallback.  That should be landing
shortly.

v2.23.0 | Report a Bug | By Email