Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

[Brian Smith <[e-mail]>]

On Mon, Oct 20, 2014 at 5:51 AM, Bodo Moeller <[e-mail]> wrote:

> Manuel Pégourié-Gonnard <[e-mail]>:
>
>> On 26/09/2014 06:00, Joseph Salowey (jsalowey) wrote:
>>
>
>
>> > This is an announcement for the working group last call for
>> > draft-ietf-tls-downgrade-scsv-00.  Please review the document and send
>> your
>> > comments to the list by Friday, October 17, 2014.
>>
>
>
>> Just to mention that I just implemented this. As expected (since it's one
>> of the
>> design goals of the draft), it was very easy.
>>
>> The only problem I ran into was an interop issue with OpenSSL, which
>> apparently
>> does not like it if the SCSV appears before the actual ciphersuites in the
>> ciphersuite list. If the intention of the draft was that the SCSV MUST be
>> placed
>> after the actual ciphersuites, it would be good to state so using
>> normative
>> language, rather than the current one which doesn't look normative:
>
>
> This is not meant to be normative -- it's a bug in OpenSSL's server-side
> code. [If ClientHello.cipher_suites includes TLS_FALLBACK_SCSV, all
> following cipher suites are ignored by the server. This will be fixed in
> the next release.]
>

For compatibility reasons, clients should put the renegotiation info and
TLS_FALLBACK_SCSV at the end of the cipher suite list, to avoid this bug
and similar bugs in other server software. This should be added to the
draft too.

Cheers,
Brian