Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

[Bodo Moeller <[e-mail]>]

Brian Smith <[e-mail]>:

> On Fri, Sep 26, 2014 at 12:34 AM, Bodo Moeller <[e-mail]> wrote:
>


> >> I'm OK with that, but if this is the real reason for the MUST, then
> >> it's not particularly clear.
> >
> > Hm, maybe so. I can add a brief note showing how the handshake would
> fail if
>

*Could* fail, sorry. (As already explained by Martin, the problem appears
if by the time you try to resume, the server supports additional protocol
versions. Of course that could also happen for an immediate retry, and
you'll have to live with it then; so I wonder if that "MUST" isn't too
strict after all: if you're willing to start over
on inappropriate_fallback, you might actually prefer to send
TLS_FALLBACK_SCSV *in order* to get a connection failure if the server has
been updated.)

> the server acts on the SCSV in this case, but I don't think the document
> > should have to explain why we require the client to omit the SCSV rather
> > than having the server ignore it. (Why would you want to send it if
> nothing
> > follows from that?)
>
> Here is what the draft actually says:
>
>       However, as an exception to the above, when the client intends to
>       perform an abbreviated handshake to resume a previously negotiated
>       session and sets ClientHello.client_version to the protocol
>       version negotiated for that session, the client MUST NOT include
>       TLS_FALLBACK_SCSV in ClientHello.cipher_suites.
>
> So, if the client does NOT set ClientHello.client_version to the
> version negotiated for that session, then the client MAY send the SCSV
> in the resumption handshake.
>
> Now, if the server could indicate that it supports the SCSV somehow in
> its ServerHello, then the client could save that acknowledgement in
> the session state, and then make sure that it always sets
> ClientHello.client_version to the highest version it supports,
> regardless of the version that it negotiated for the session it is
> trying to resume.


Hm, if you can set ClientHello.client_version to the highest version
supported by the client and the server tolerates that, you shouldn't be
employing the fallback mechanism with this server in the first place.

Bodo