Re: [TLS] Last Call: <draft-ietf-tls-downgrade-scsv-03.txt> (TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks) to Proposed Standard

[Xiaoyin Liu <[e-mail]>]

Hi, Yoav, Thanks for your reply! Here is my answer: What do you mean by tolerance here? Since no servers at all support TLS 1.3, they have to break this kind of connection. Does it count as tolerance if they issue the proper alert?            A: I count a server tolerant to TLS 1.3 if and only if it replies a ServerHello handshake message with its version being TLS 1.2 or lower. Sending fatal alert (such as handshake failure, decode error, and protocol version) is not considered as tolerance. By the way, I wonder what's the proper alert here, since RFC 5246 Appendix E.1 requires "if a TLS server receives a ClientHello containing a version number greater than the highest version supported by the server, it MUST reply according to the highest version supported by the server".
 Does tolerance here and below means the same thing as above? In other words, do they count as tolerant if they break the connection, or only if they respond in TLS 1.2, 1.1, or 1.0 ?          A: Yes, all of the "tolerance" means the same thing: only if they respond in TLS 1.2, 1.1, 1.0 or SSL 3.0.  Best, Xiaoyin
 Subject: Re: [TLS] Last Call: <draft-ietf-tls-downgrade-scsv-03.txt> (TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks) to Proposed Standard
From: [e-mail]
Date: Wed, 21 Jan 2015 08:47:15 +0200
CC: [e-mail]
To: [e-mail]

Hi, Xiaoyin
Thank you for the effort. I have one question. See below
On Jan 21, 2015, at 6:01 AM, Xiaoyin Liu <[e-mail]> wrote:Hi,
 
I just finished a scan of Alexa top 1 million websites to test for TLS version intolerance. I hope this information can be useful in the discussion of downgrade SCSV.
 
For each site, I made at most four attempts with the following order to fallback:
(TLS 1.3, TLS 1.3) -> (TLS 1.0, TLS 1.3) -> (TLS 1.0, TLS 1.2) -> (TLS 1.0, TLS 1.0)
where the first is TLS record layer version, and the second is Client Hello version.
 
Here is the result:
(1) Number of sites scanned: 1,000,001
(2) Number of DNS Error: 45,402
(3) Number of sites that refuse TCP connection on port 443 (RST, timeout): 289,334
(4) Number of sites that fail sending ServerHello in all 4 attempts: 238,846
(5) Number of sites that are tolerant to (TLS1.3, TLS1.3): 397,152 (93.1%)

What do you mean by tolerance here? Since no servers at all support TLS 1.3, they have to break this kind of connection. Does it count as tolerance if they issue the proper alert?
(6) Number of sites that need to fallback to (TLS1.0, TLS1.3): 22,461 (5.3%)

Does tolerance here and below means the same thing as above? In other words, do they count as tolerant if they break the connection, or only if they respond in TLS 1.2, 1.1, or 1.0 ?
(7) Number of sites that need to fallback to (TLS1.0, TLS1.2): 6,352 (1.5%)
(8) Number of sites that need to fallback to (TLS1.0, TLS1.0): 454 (0.1%)

The total number of TLS enabled sites is 426,419. TLS 1.3 intolerant sites (7 and 8) are about 1.6%. TLS 1.2 intolerant sites are about 0.1%. Also it shows setting a lower record layer version does improve compatibility a lot. An example is https://paypal.com is intolerant to (TLS 1.3, TLS 1.3) but is tolerant to (TLS 1.0, TLS 1.3). Please note that I did not validate certificates nor check the integrity of handshakes. I closed the connection immediately after receiving ServerHello.
 
If my data is accurate, I am against making downgrade SCSV a proposed standard, and I believe browsers should stop insecure fallback. At least, the percentage of TLS 1.2 intolerant sites is low enough. 
I think you will find that browser vendors may not consider this low enough. 
For TLS 1.3, I think maybe browser vendors can announce a deadline, after which fallback to TLS 1.2 will no longer be accepted? Or simply break them? Both are reasonable to me.
OpenSSL has been version tolerant forever. As has Microsoft’s SChannel. I’m not sure, but I think the Java library is as well. The people running these servers are using some exotic technology, and it’s not clear they know how to upgrade them.
 Also I want to point out that if even as few as 1.6% sites won't upgrade their servers, can we count on most of the rest 98% supporting SCSV?

This is a strong argument, especially if we could obtain a list of high-value sites in the sense that the data on them is high-value. Sites like Facebook, banking, shops, email providers, dating sites, and check those. 
Yoav