Re: [TLS] Cipher suite values to indicate TLS capability

[Adam Langley <[e-mail]>]

On Fri, Jun 8, 2012 at 3:35 AM, Nikos Mavrogiannopoulos <[e-mail]> wrote:
> If you want to only prevent against the attacker that wants to rollback
> the session to SSL 3.0, then all you need to do is to perform the proper
> TLS protocol negotiation, which protects against that. If it doesn't
> work warn the user.

Yes, the aim is to prevent an attacker performing a downgrade attack to SSLv3.

Warning the user assumes that the user can understand what we're
trying to tell them which is not true here.

> What happens if we have a buggy server that incorrectly implements the
> fallback detection mechanism? We define another one?

The SCSV for the renegotiation indication extension was deployed
without any serious issues, which is strong evidence that we can
viably deploy other SCSV values.

> If the problem is incorrect implementations, then just fix the incorrect
> implementations. If you cannot, then do not interoperate with them. If
> all major browsers do that, the owners would fix it.

It's not clear, from a global point of view, that the benefits of
avoiding SSLv3 downgrades exceed the cost of updating all these
servers. By definition these servers are unmaintained and probably
very expensive to update. They're also quite numerous.

Certainly, from a moral point of view, we should not be baring the
costs of these server's bugs. By abandoning these buggy devices on the
network, vendors (which presumably turned a profit by doing so) are
imposing externalities on the world. It's basically a form of
pollution.

I understand and share an anger towards these practices but, none the
less, we find ourselves with these barrels of toxic waste lying around
and have to deal with it. It's the cost of an open network and I'd
still choose it over a closed network.


Cheers

AGL