Re: [TLS] One approach to rollback protection

[Martin Rex <[e-mail]>]

Nikos Mavrogiannopoulos wrote:
> 
> Martin Rex wrote:
> > 
> > I do _not_ want to retire the original TLS version negotiation,
> > just like to see an alternative "hinting" being standardized to
> > accomodate a ~10 year transition period to get over TLS version-related
> > interop problems that exist in today's installed base.
> 
> For what reason? Since more and more people demand TLS 1.1 support more 
> and more servers will make sure that they interoperate with it.

More and more browsers support reconnect fallbacks for version-intolerant
and extension-intolerant servers -- and since it is impossible to
protect against attackers forcing that fallback, a browser implementing
and offering TLSv1.1 is *NOT* a solution to the problem at all.

Firefox added the reconnect fallback although it supports at most TLSv1.0
and only has to deal with the comparatively small extension-intolerant
servers.  As soon as browsers start sending TLSv1.1 or TLSv1.1 in
ClientHello.client_version, they will be faces with the much more
serious TLS version intolerance problem, in particular with respect
to incorrect RSA premaster secret client_version checks.

So for browsers -- the only clients that are affected by BEAST-style
attacks besides SSL-VPNs, there currently is no robust protection
available.


>
> Creating a new approach to negotiate versions might even create more 
> interoperability problems. Why do you think implementers that got wrong 
> the original simple negotiation will get right this one?

Lack of testing (methodology).


-Martin