Re: [TLS] 2nd WGLC: draft-ietf-tls-downgrade-scsv

[Brian Smith <[e-mail]>]

On Tue, Nov 25, 2014 at 8:46 PM, Sean Turner <[e-mail]> wrote:
> This message initiates the 2nd WGLC for draft-ietf-tls-downgrade-scsv-02.   Please review the document and send your comments to the list by Friday, December 12, 2014.

The current draft [1] says "(Since the cipher suite list in the
ClientHello is ordered by preference, with the client's favorite
choice first, signaling cipher suite values will generally appear
after all cipher suites that the client actually intends to
negotiate.)"

The text in the draft should be changed to read something like
"Clients SHOULD put the TLS_FALLBACK_SCSV after all cipher suites that
the client actually intends to negotiate."

Recently, it has been shown that it is problematic to put the
TLS_FALLBACK_SCSV cipher suite ahead of any real cipher suites in the
ClientHello, because doing so causes unintended handshake failures.

I don't know whether it matters whether the TLS_FALLBACK_SCSV appears
before or after the secure renegotiation SCSV (when the secure
renegotiation SCSV appears after all the cipher suites that the client
actually intends to negotiate).

Nit: The current draft says "Code Components extracted from this
document must include Simplified BSD License text as described in
Section 4.e of the Trust Legal Provisions [...]." The "Section 4" in
that statement is a hyperlink to section 4 of the draft, but that is
clearly not what was intended.

Cheers,
Brian

[1] https://tools.ietf.org/html/draft-ietf-tls-downgrade-scsv-02