Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

[Bodo Moeller <[e-mail]>]

Andrey Jivsov <[e-mail]>:

 If a server is
>> capable of 1.2, but configured with 1.1, only downgraded handshakes to
>> 1.0 or SSL will cause the alert to be generated.
>>
>

>  I don't think this is what Bodo is saying. Sec 3 (server) is missing the
> concept of "configured", while the sec 4 (client) has it.
>

That's an inconsistency that I can fix. If a protocol version is completely
disabled in the server, of course using that version isn't supposed to be
an "inappropriate fallback".



> My example again is:
>
> * the server capable of TLS 1.2 and lower. I mean, it will accept TLS 1.2
> ClientHello.
>

And will negotiate TLS 1.2?

* the pair of the server and client happened to only able negotiate a
> ciphersuite that is set on the server to be SSL3.0
> * client sends TLS1.1+TLS_FALLBACK_SCSV
>
> So, what is server's maximum version? Bodo says it's TLS1.2. Thus,
> TLS1.1+TLS_FALLBACK_SCSV must fail. I say it's harsh because this pair can
> only negotiate SSL 3.0.
>

If the server is willing to negotiate TLS 1.2, then this is an
inappropriate fallback and will fail. It's not reasonable to optimize the
specification to provide extra error redundancy for blatantly stupid
servers as in this scenario (at the cost of making it more complex, which
can lead to other problems).

Bodo