Re: [TLS] Call for acceptance of draft-moeller-tls-downgrade-scsv

[Bodo Moeller <[e-mail]>]

Martin Rex <[e-mail]>:

The negotiation could work like this:
>


>      Client                                               Server
>
>       minimal ClientHello w/SCSV    -------->
>                                                       ServerHello w/SCSV
>                                    <--------      ServerHelloDone
>       ClientHello                   -------->
>                                                       ServerHello
>                                                      Certificate*
>                                                ServerKeyExchange*
>                                               CertificateRequest*
>                                    <--------      ServerHelloDone
>       Certificate*
>       ClientKeyExchange
>       CertificateVerify*
>       [ChangeCipherSpec]
>       Finished                     -------->
>                                                [ChangeCipherSpec]
>                                    <--------             Finished
>       Application Data             <------->     Application Data
>

Well, it could, but I certainly think it's fair to say that getting this
deployed will take much more design and implementation work than
deploying TLS_FALLBACK_SCSV.

There's actually no conflict here.  TLS_FALLBACK_SCSV provides an
immediately available simple fix for clients that use protocol fallback
strategies.  Later, if and when a more elaborate solution is available (or
if broken servers simply are no longer an issue, whichever happens first),
either clients won't have to send TLS_FALLBACK_SCSV (if there's no fallback
reconnect), or servers won't have to abort the connection (if they are able
to negotiate a non-downgraded protocol version as in your protocol sketch).

(I'm highly skeptical that extending the protocol by another round as shown
in your diagram would be desirable overall and that this would solve a
real-world problem in the real world, but the utility of TLS_FALLBACK_SCSV
does not depend on that question.)

Bodo