Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

[Andrey Jivsov <[e-mail]>]

Server list of acceptable ciphersuites is sometimes protocol-specific. 
For example, AES-GCM suites are associated with TLS1.2.

There may be ciphersuites that apply to all protocols but only 
configured to be available with lower ones on some servers. For example, 
DES-CBC3-SHA (or RC4-SHA, etc) might be made available for SSL3.0 only.

Let's assume that the server supports all protocols SSL3.0-TLS1.0, but 
this server supports DES-CBC3-SHA with SSL3.0 only.

Assume that a client only negotiates DES-CBC3-SHA (or that this would be 
the only intersection)

Client does {DES-CBC3-SHA} with TLS1.2 in ClientHello. The pair 
negotiates DES-CBC3-SHA with SSL3.0.

Client decides to drop to TLS1.1 (due to network glitch, etc). It SHOULD 
do {DES-CBC3-SHA,TLS_FALLBACK_SCSV} with TLS1.1 per sec 4. The server 
MUST fail with inappropriate_fallback per sec 3.

Is it a good idea to reject a more secure protocol than the server can 
possibly negotiate with this client? Did I interpret the draft correctly?

( The scenario applies in other cases when you adjust some of values 
here. For example, we expect TLS1.3 intolerant servers, so TLS1.2+SCSV 
was advocated in this case this list. The server is expected to fail 
with inappropriate_fallback even when it doesn't have a match with 
ciphersuites associated with TLS1.2. )

Thank you.