Re: [TLS] A new consensus call on ALPN vs NPN (was ALPN concerns)

[Brian Smith <[e-mail]>]

On Wed, Dec 11, 2013 at 11:14 AM, Bill Frantz <[e-mail]> wrote:
> We should not insist that a client using the new protocol be able to connect
> of a tls 1.2 server (or below) as a result of tls level negotiation. The
> fallback mechanisms in most browsers can cover that need. The extra design
> freedom will allow us to easily encrypt data that was previously sent in the
> clear without worrying about backward compatibility.

I think us browser people might have unintentionally misled people
about our eagerness to reconnect with downgraded security properties.
I, and other browser people I know, consider it mis-feature, and we'd
love to find a way to stop doing it. So, trying to connect via "TLS
2.0" that has better security/privacy properties, and then insecurely
falling back to TLS 1.2 with worse security/privacy properties, is
something that I'd definitely want to avoid.

There may be cases where the
connect-and-then-reconnect-with-different-parameters approach becomes
useful, but the key there is "different" and not "worse."

Besides being an ineffective security/privacy measure (since any MitM
could induce the fallback to from "TLS 2.0" to TLS 1.2), it would also
be unacceptable due to the added latency for any site that hadn't
upgraded to "TLS 2.0." We are many years away from that becoming a
viable thing for us to do.

Cheers,
Brian
-- 
Mozilla Networking/Crypto/Security (Necko/NSS/PSM)