Re: [TLS] consensus on backwards compatibility changes

[Dave Garrett <[e-mail]>]

On Thursday, February 12, 2015 09:24:37 pm Michael Clark wrote:
> * Spec can be explicit that it is NOT RECOMMENDED for TLSv1.3 clients to
> negotiate SSLv3 { 3, 0 } not to be conflated with the record layer lower
> bound.

https://tlswg.github.io/tls13-spec/#rfc.appendix.E.2

SSL negotiation total prohibition was committed earlier today.

> * Believe ClientHello { 3, 0 } { 3, 4 } may be more guarded.

{3,1} is current practice for some clients at the moment. General goal is to fix it to something static that works and makes sense. If we wish to avoid information leakage, the best value is whatever is already used commonly.

> prefer it to the minimum supported
> backwards compatible record layer version

Agreed. It depends on if you consider SSL3 or TLS1 to be that minimum.

> * { 3, 1 } can be regarded as the binary compatibility pivot point due
> to its extension support. In that case I favor { 3, 1 }

My reasoning as well.

Either version number is acceptable. The "best" value could be empirically determined by surveying servers for which gets the least intolerance when attempting to negotiate 1.3.

> 2.) "Negotiating with buggy servers"
> 
> * Primary observation. This section is at odds with the consensus for
> TLSv1.3 implementation to not negotiate anything lower than TLSv1.0 { 3,
> 1 } with >= TLSv1.2.
> * While the protocol lower bound may not be in scope for the TLSv1.3
> spec; the security concern for bugger servers should be; a small number
> of buggy servers lead to clients with attack vectors
> * Buggy servers should not be named or supported in a security protocol
> draft.
> 
> As an observer I would prefer to see this text changed from this:
> 
>     "and may require multiple connection attempts by the client."
> 
> to something like this:
> 
>     "and may require multiple connection attempts by the client, however
> it is NOT RECOMMENDED that clients make multiple connection attempts as
> this provides a vector for downgrade attacks"

That block of text is pre-existing, just moved. A NOT RECOMMENDED line sounds appropriate if nobody objects. Insecure fallback is being phased out by Mozilla, at least, and it was never really a good idea.

Alternatively, I could just drop the whole paragraph/subsection. This set of changes are to attempt to address this concern better, so maybe they're sufficient without this buggy servers bit?


Dave