Re: [TLS] A new TLS version negotiation mechanism

[Dave Garrett <[e-mail]>]

On Thursday, March 12, 2015 01:01:27 am Stephen Checkoway wrote:
> 
> On Mar 11, 2015, at 2:56 PM, Dave Garrett <[e-mail]> wrote:
> 
> > On Tuesday, January 20, 2015 11:01:31 pm Xiaoyin Liu wrote:
> >> (5) Number of sites that are tolerant to (TLS1.3, TLS1.3): 397,152 (93.1%)
> >> (6) Number of sites that need to fallback to (TLS1.0, TLS1.3): 22,461 (5.3%)
> >> (7) Number of sites that need to fallback to (TLS1.0, TLS1.2): 6,352 (1.5%)
> >> (8) Number of sites that need to fallback to (TLS1.0, TLS1.0): 454 (0.1%)
> >> 
> >> The total number of TLS enabled sites is 426,419. TLS 1.3 intolerant sites (7 and 8) are about 1.6%.
> 
> Most of this is about the record layer version

I just wanted to post the full data set here so it wasn't out of context.

> The real data here is that 1.5% of servers are intolerant of 1.3 but tolerate 1.2. So that was (a) and (b) in my list but it's pretty hard to measure (c): servers that aren't maintained or can't be upgraded.
> 
> I remain unconvinced, but others can weigh in.

Let me put it to you this way: ~0.1% of servers are TLS 1.2 intolerant and browser vendors are STILL having trouble dropping insecure fallback, if they are attempting it at all. The TLS 1.3 intolerance problem is over an order of magnitude worse.

To be precise, most of these servers are likely considered maintained and can technically be upgraded, but that doesn't mean they actually will. Starting out with this untamed mess could discourage TLS 1.3 adoption and will encourage browsers to do insecure fallback for TLS 1.3.

For a marginally less hacky route, we could basically just make a better version of SCSV and mandate its use in the TLS 1.3 spec. Simply have a max supported version extension which has nothing other than the max client TLS version in it, include it in every ClientHello, and use the normal version negotiation. If a 1.3 ClientHello fails, an insecure fallback to 1.2 can be done, however a 1.3 server can doublecheck versions and know the first attempt merely failed and 1.3 can actually be negotiated instead. The client would get a 1.3 ServerHello and could continue the connection normally, but note an error somewhere. (whatever dubious security UI indicator the browser uses) This is essentially the existing system with an extension as a backup method, but it enshrines downgraded fallbacks as valid. (we might be ok with that if this is done properly) It does have the benefit of shining a spotlight on broken implementations, though.


Dave