Re: [TLS] One approach to rollback protection

[Nikos Mavrogiannopoulos <[e-mail]>]

On 09/27/2011 01:44 AM, Eric Rescorla wrote:
> I've been doing some thinking about how to prevent rollback to
> TLS 1.0/SSLv3 from TLS 1.1-capable agents.
>
> Since there's very little deployment of TLS 1.1+, basically anything
> we do now will roll out more or less in parallel with TLS 1.1 deployment,
> as long as it's backward compatible.The obvious technique here is to
> stuff the relevant indicator in the cipher suites list, since we know that
> servers ignore unknown entries there.

How about servers that fail on unknown ciphersuites? (they used to 
exist). If such a thing is proposed there will be no incentive at all to 
fix the broken servers. I see Bill Frantz solution as a pragmatic one 
that does not break the protocol (a hack over hack makes the protocol so 
complicated that in a few years we'll need a clean slate redesign of 
TLS. Complexity adds security issues rarely solves them.).

regards,
Nikos