Re: [TLS] Minutes from Tuesday

[[e-mail] (Martin Rex)]

Salz, Rich wrote:
> 
> Bodo slides are at https://github.com/tlswg/wg-materials/blob/master/20141021_interim/TLS_FALLBACK_SCSV_IETF_TLS_Interim_Oct_2014.pdf   Based on list feedback, going to add some clarifications (no changes to the mechanism).  False start I-D needs to be updated since attacker can force a version; Bodo to do that. Discussion of distinguishing between TCP reset (in FF) and version intolerance. Discussion of when to 'guess' failure is transient or version intolerance. Need to add some guidance to the I-D: mixing SCSV and version-intolerant servers will cause a pain. Sean went through issues raised on mailing list.

The current fallback-scsv is embarrassing.

Rather than aborthing the TLS handshake, the server ought to include
a TLS extension in the ServerHello indicating that he recognized a
potentially inappropriate fallback and otherwise continue the TLS handshake
in the regular fashion, leaving the decision of whether&how to continue
entirely up to those clients who do perform insecure fallbacks.

This would also allow clients (browsers probably) to gather real data
on potentially incorrect fallbacks, rather than have users face random
connection failures.  Connection failures for singular object may
appear easy to identify, but if it affects only small objects within
complex pages, the underlying cause of problems may be hard to identify.

And it would then be a decision of the (fallback-performing) clients
whether and when to start hard-failing, once they've sorted out their
connection management and figured out how to deal with false positives
in their fallback heuristics.

-Martin