Re: [TLS] Minutes from Tuesday

[Bodo Moeller <[e-mail]>]

Manuel Pégourié-Gonnard <[e-mail]>:

> Martin Rex wrote:
> > Bodo Moeller wrote:



> >> [...] reacting to a fatal alert is something that all TLS
> >> implementations already know how to do.
>


> > That reaction is called interop failure.  That is the far opposite
> > of what IETF working groups are supposed to consciously cause to happen
> > when the alternative would be to make interop succeed.
>


> I'm not so sure. There are already a lot of situations where
> implementations are
> requires to make the handshake fail, eg if the verify data from the
> Finished
> message don't match, which indicates the handshake data has been tampered
> with.
> This is not entirely different, the main difference is that the suspected
> tampering happened during the previous handshake.
>
> I'm not saying breaking the handshake is the only right thing to do, I can
> see
> the benefits of the solution you suggest, but I think the simplicity of the
> current draft is a big advantage in getting it widely (and correctly)
> deployed
> sooner rather than later, which IMO outweighs the advantages of a more
> complex
> approach.
>

Right. If we figure out how to make more handshakes succeed immediately
without a fallback dance, that's completely orthogonal to TLS_FALLBACK_SCSV
(which won't be needed in such handshakes).

Any such proposal will be considerably more complex than the
TLS_FALLBACK_SCSV mechanism, and I think there's no excuse for allowing
downgrade attacks to happen until it is deployed.

Bodo