Re: [TLS] One approach to rollback protection

Nikos Mavrogiannopoulos <nmav@gnutls.org> Tue, 27 September 2011 07:04 UTC

Return-Path: <n.mavrogiannopoulos@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 00D4621F8E20 for <tls@ietfa.amsl.com>; Tue, 27 Sep 2011 00:04:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.574
X-Spam-Level:
X-Spam-Status: No, score=-3.574 tagged_above=-999 required=5 tests=[AWL=0.025, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wH-taj3WKFRz for <tls@ietfa.amsl.com>; Tue, 27 Sep 2011 00:04:57 -0700 (PDT)
Received: from mail-wy0-f172.google.com (mail-wy0-f172.google.com [74.125.82.172]) by ietfa.amsl.com (Postfix) with ESMTP id 1A39A21F8DFE for <tls@ietf.org>; Tue, 27 Sep 2011 00:04:56 -0700 (PDT)
Received: by wyh21 with SMTP id 21so5223654wyh.31 for <tls@ietf.org>; Tue, 27 Sep 2011 00:07:41 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=sender:message-id:date:from:user-agent:mime-version:to:subject :references:in-reply-to:content-type:content-transfer-encoding; bh=pKUiSe87FTfut2IIsL5MbWtVrwBa0U5nXGelppdt5nk=; b=KBSX9z1wibP52EShIO2r4NRSM05m7yrMy/HtVevuPkoukHWHaZCR0edGoxujGkhbVl lqxx7zRPLcU7yNmvOSNfPx1ZxrgPHxPp5Depk516CMIY8uAs1otHw5wPzS/+Y+4sHeb7 qy8+rZRP525liVfqjdhfx2J38Iw2wLKB9QSi0=
Received: by 10.227.35.196 with SMTP id q4mr2180782wbd.113.1317107261299; Tue, 27 Sep 2011 00:07:41 -0700 (PDT)
Received: from [10.100.2.14] (94-225-167-75.access.telenet.be. [94.225.167.75]) by mx.google.com with ESMTPS id l18sm30888315wbo.23.2011.09.27.00.07.40 (version=SSLv3 cipher=OTHER); Tue, 27 Sep 2011 00:07:40 -0700 (PDT)
Sender: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
Message-ID: <4E81764A.7050402@gnutls.org>
Date: Tue, 27 Sep 2011 09:07:54 +0200
From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.21) Gecko/20110831 Icedove/3.1.13
MIME-Version: 1.0
To: tls@ietf.org
References: <CABcZeBNFtVBh7a=j4LE73Q0c-W8KGe4aKNBVZam1qOZr=aRaRQ@mail.gmail.com>
In-Reply-To: <CABcZeBNFtVBh7a=j4LE73Q0c-W8KGe4aKNBVZam1qOZr=aRaRQ@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [TLS] One approach to rollback protection
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 Sep 2011 07:04:58 -0000

On 09/27/2011 01:44 AM, Eric Rescorla wrote:
> I've been doing some thinking about how to prevent rollback to
> TLS 1.0/SSLv3 from TLS 1.1-capable agents.
>
> Since there's very little deployment of TLS 1.1+, basically anything
> we do now will roll out more or less in parallel with TLS 1.1 deployment,
> as long as it's backward compatible.The obvious technique here is to
> stuff the relevant indicator in the cipher suites list, since we know that
> servers ignore unknown entries there.

How about servers that fail on unknown ciphersuites? (they used to 
exist). If such a thing is proposed there will be no incentive at all to 
fix the broken servers. I see Bill Frantz solution as a pragmatic one 
that does not break the protocol (a hack over hack makes the protocol so 
complicated that in a few years we'll need a clean slate redesign of 
TLS. Complexity adds security issues rarely solves them.).

regards,
Nikos