Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

[Florian Weimer <[e-mail]>]

On 10/15/2014 11:22 AM, Bodo Moeller wrote:
> Note that if your server does not support formally obsolete protocol
> versions, TLS_FALLBACK_SCSV support is a no-op.

No, only if you support exactly a single TLS version.  Then the presence 
of TLS_FALLBACK_SCSV support in the server code is indeed unobservable.

(As long as the presence of this feature is observable, server operators 
will be bullied into implementing it, with broken network-based testers 
etc.  It's not really optional.)

> Otherwise, you're making real-world tradeoffs, and I think
> TLS_FALLBACK_SCSV is a reasonable one to make (with minimal server-side
> logic to achieve the objective), not "punishment".

It's still punishes those who are responsible netizens and can update 
their servers—simply because they have to apply an update.  Their client 
base doesn't even directly benefit from that, it's just to enable their 
clients to preserve their own brokeness, so that they can continue to 
connect to broken servers that may or may not be out there.

Meanwhile, those who operate TLS-version-intolerant servers have to 
do—nothing.  That's what I find unfair and unsustainable.

-- 
Florian Weimer / Red Hat Product Security