Re: [TLS] Fwd: New Version Notification for draft-bmoeller-tls-downgrade-scsv-00.txt

[Bodo Moeller <[e-mail]>]

>
> https://tools.ietf.org/html/draft-bmoeller-tls-downgrade-scsv-00#section-3
>
>    This section specifies server behavior when receiving the
>    TLS_DOWNGRADE_SCSV cipher suite from a client in
>    ClientHello.cipher_suites.
> [...]
>
> To me, this part of your document places two requirements on the _server_
> to abort the handshake.


Yes. My point is that there's no server-side guesswork involved -- no
"flawed or unjustified" assumptions. This is entirely client-directed
behavior!


In a security protocol, it is a design failure to rely on a connection
> peer to enforce one's own policy (the connection peer may be an adversary),


If the authenticated handshake for a client-side protocol downgrade goes
through and you're actually talking to an adversarial server, the same
adversary could have negotiated the downgraded protocol version immediately
via proper TLS version negotiation.  This entire specification is only
about scenarios in which the client *is* willing to use the downgraded
protocol if necessary and *is*, in particular, willing to rely on it at
least for authentication and integrity-check purposes.  In other words, you
are not relying on an arbitrary connection peer, but on an authenticated
server.

Bodo