Re: [TLS] Call for acceptance of draft-moeller-tls-downgrade-scsv

[Marsh Ray <[e-mail]>]

Forgive me if this has been discussed before, sometimes I have trouble
wrapping my head around all this version negotiation stuff.

The draft http://tools.ietf.org/html/draft-bmoeller-tls-downgrade-scsv-01 states:
>  All unnecessary protocol downgrades are undesirable (e.g., from TLS
>  1.2 to TLS 1.1 if both the client and the server actually do support
>  TLS 1.2); they can be particularly critical if they mean losing the
>  TLS extension feature (when downgrading to SSL 3.0).

While this is certainly true, it is also 'undesirable' to increase
the rate of spurious handshake failures for clients. So it's
a lesser-of-two-evils tradeoff. Absent a plausible attack, an
increased rate of total interop failure seems like the more
tangible and quantifiable evil.

So what's the attack that this SCSV is trying to solve?

Could someone please give a scenario in which:
A. The legitimate client supports ver > TLS 1.0.
B. The attacker is able to trigger client fallback to ver <= TLS 1.0
C. *All* servers having the private key for a valid cert support
   ver > TLS 1.0.
D. The attacker is able to exploit some weakness with the
   downgraded ver <= TLS 1.0 connection that he
   can *not* exploit in ver > TLS 1.0.
E. The attacker is *not* able to actually impersonate the legitimate
   server over this downgraded (ver <= TLS 1.0) connection.

Rationale:
A. The value of this proposal comes when using post-TLS 1.0 aware clients.
B. Obvs.
C. The value of this proposal comes when using post-TLS 1.0 aware servers,
   but if any legitimate server only supports ver <= TLS 1.0, the attacker
   can forward the initial connection to that server.
D. Otherwise, what would he gain by the downgrade?
E. If the attacker could successfully impersonate the legitimate server
   over the downgraded connection, he would simply ignore the SCSV,
   right?

I don't mean for this to sound like a rhetorical question, I'd just like
to see what such a scenario would look like. I'm personally still on the
fence about this one.

Thanks,

- Marsh
--------------------------------
My personal opinions only, usual disclaimers apply.