From: Rob Trace <Rob.Trace@microsoft.com>
To: "tls@ietf.org" <tls@ietf.org>
Thread-Topic: Re: [TLS] Downgrade SCSV info
Thread-Index: Ac/+9O5weiJnd0SQTLmp/+CUEBE1LA==
Date: Thu, 13 Nov 2014 03:54:12 +0000
Message-ID: <d51dcf00811740edb16aade02a5d8fe5@CY1PR0301MB0892.namprd03.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: multipart/alternative;
 boundary="_000_d51dcf00811740edb16aade02a5d8fe5CY1PR0301MB0892namprd03_"
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/7MB8E-7juKD8l5pHdacQV9AhhKA
Subject: Re: [TLS] Downgrade SCSV info
Precedence: list

--_000_d51dcf00811740edb16aade02a5d8fe5CY1PR0301MB0892namprd03_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

> Right, although it couldn't hurt for the client to try TLS 1.1 next in ca=
se
> it sees an inappropriate_fallback alert. (Then in the end you have
> essentially the same outcome as if trying the protocols in decreasing ord=
er,
> in the presence of an active attacker forcing you to downgrade.)

When we looked at the fallback to HTTP 1.1, it was just as Martin stated an=
d there were almost 0 times when the connection completed over TLS 1.1.  Th=
e 1.1 fallback was a lot of wasted roundtrips and did not provide any value=
.

I am not sure what a wasted fallback to HTTP 1.1 would provide with SCSV, i=
n that the TLS 1.0 fallback would still result in the inappropriate_fallbac=
k before we send any data.

Thanks!!

-Rob

--_000_d51dcf00811740edb16aade02a5d8fe5CY1PR0301MB0892namprd03_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:#0563C1;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:#954F72;
	text-decoration:underline;}
pre
	{mso-style-priority:99;
	mso-style-link:"HTML Preformatted Char";
	margin:0in;
	margin-bottom:.0001pt;
	font-size:10.0pt;
	font-family:"Courier New";}
span.EmailStyle17
	{mso-style-type:personal-compose;
	font-family:"Calibri",sans-serif;
	color:windowtext;}
span.HTMLPreformattedChar
	{mso-style-name:"HTML Preformatted Char";
	mso-style-priority:99;
	mso-style-link:"HTML Preformatted";
	font-family:"Courier New";}
.MsoChpDefault
	{mso-style-type:export-only;
	font-family:"Calibri",sans-serif;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72">
<div class=3D"WordSection1">
<p class=3D"MsoNormal">&gt; Right, although it couldn't hurt for the client=
 to try TLS 1.1 next in case<o:p></o:p></p>
<p class=3D"MsoNormal">&gt; it sees an inappropriate_fallback alert. (Then =
in the end you have<o:p></o:p></p>
<p class=3D"MsoNormal">&gt; essentially the same outcome as if trying the p=
rotocols in decreasing order,<o:p></o:p></p>
<p class=3D"MsoNormal">&gt; in the presence of an active attacker forcing y=
ou to downgrade.)<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">When we looked at the fallback to HTTP 1.1, it was j=
ust as Martin stated and there were almost 0 times when the connection comp=
leted over TLS 1.1.&nbsp; The 1.1 fallback was a lot of wasted roundtrips a=
nd did not provide any value.<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">I am not sure what a wasted fallback to HTTP 1.1 wou=
ld provide with SCSV, in that the TLS 1.0 fallback would still result in th=
e inappropriate_fallback before we send any data.<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">Thanks!!<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">-Rob<o:p></o:p></p>
</div>
</body>
</html>

--_000_d51dcf00811740edb16aade02a5d8fe5CY1PR0301MB0892namprd03_--