Re: [TLS] To extend or not to extend

[Nelson B Bolyard <[e-mail]>]

On 2009-11-15 03:13 PDT, Joseph Salowey (jsalowey) wrote:
> We need to close on this issue.  

Agreed!

> E. The RI proposal has an issue if the client is patched and the server
> does not implement the SSL 3.0 and the TLS 1.x specs correctly and the
> client as a lenient policy which allows connection to insecure servers.
> In this case the client would have to implement some fallback logic
> (reconnect without extensions) to deal with broken servers.  This logic
> is well-known, but it leaves a roll-back attack open.  

AFAIK, there is a small number of well known client products (browsers)
that do this today.  These products offer ("push") updates quite frequently.

I think it is probable that these products will alter their fall-back logic
in light of this vulnerability, so that it will not be a trivial way for
attackers to bypass the fix for the vulnerability.

> Situation E is one that we expect to get less common because we want all
> implementations to get patched and clients may start requiring the fix
> because this is the only way they can protect themselves.   

Agreed.