Re: [TLS] Comments/Questions on draft-gutmann-tls-encrypt-then-mac-00.txt

[[e-mail] (Martin Rex)]

Bodo Moeller wrote:
> > Instead of particular versions, it seems to me that an indicator of "I
> >> tried to connect using a higher version than I'm using now but had to
> >> fall back to this verion" would cover any case now or later.
> >>
> >
> > Indeed that's what I ended up writing down for an Internet Draft.
> >
> 
> Now here:
> 
> http://www.ietf.org/internet-drafts/draft-bmoeller-tls-downgrade-scsv-00.txt

OH NO, not again!!

Any kind of specification for TLS, that suggests to the server
to apply heuristics and make (often flawed or unjustified) assumptions
about what the client may want or may not want and have the _server_
abort the handshake rather than the client, are a REALLY BAD IDEA and
squarely against the IETF spirit to promote interop.

Fatal SSL alerts in particular, are worst of all, because they do often
do not give any clue, are not ever sent by a number of TLS implementations
(you just see the connection close/reset), and are hardly/poorly visualized
or not even accessible on many TLS clients.

If anything, then such a "downgrade protection discovery" signaling
cihper suites should cause the server to respond with a ServerHelloExtension
listing the features that the server supports and would be capable
of processing properly when present in ClientHello, and leave the
decision, whether to abort the handshake and whether to tell or ask
the user about any perceived problems first, entirely up to the client.


-Martin