Re: [TLS] Protocol version for inappropriate_fallback alerts (was: Re: I-D Action: draft-ietf-tls-downgrade-scsv-01.txt)

[[e-mail] (Martin Rex)]

Bodo Moeller wrote:
>>
>> But I do _not_ think that a MUST for ClientHello.client_version
>> would be appropriate for an fatal alert that is sent instead
>> of ServerHello.  For alerts that early in the handshake a server
>> may for simplicity reuse the record layer protocol that was used
>> for the in coming ClientHello.
> 
> 
> God point.  If the record-layer version number differs from
> ClientHello.client_version, the client should really be ready to accept
> both version numbers. So what about the following?
> 
> [...]  The record layer version number for this alert MUST be set to either
> ClientHello.client_version (as it would for the Server Hello message if the
> server was continuing the handshake), or to the record layer version number
> used by the client.


I thought you were looking for simplicity and ease-of-implementation.
I believe you should get rid of the MUST.

we're talking about the text on page 3 of your I-D, right?

   o  If TLS_FALLBACK_SCSV appears in ClientHello.cipher_suites and the
      highest protocol version supported by the server is higher than
      the version indicated in ClientHello.client_version, the server
-     MUST respond with a fatal inappropriate_fallback alert (unless it
-     responds with a fatal protocol_version alert because the version
-     indicated in ClientHello.client_version is unsupported).  The
-     record layer versio
- 2000
- n number for this alert MUST be set to either
-      ClientHello.client_version (as it would for the Server Hello
-      message if the server was continuing the handshake), or to the
-      record layer version number used by the client.
+     MUST respond with a fatal inappropriate_fallback alert.  There
+     has not been a protocol version negotiated at this point of the
+     TLS handshake, so the inappropriate_fallback alert, like any
+     other fatal alert this early during the handshake, should use
+     a record layer protocol_version that the client can reasonably
+     be expected to understand, such as the record layer protocol_version
+     that carried the client's ClientHello handshake message or the
+     ClientHello.client_version.

I have a serious problem with the text in the parentheses in your current
version (from above, re-flowed):

-     (unless it responds with a fatal protocol_version alert because the
-      version indicated in ClientHello.client_version is unsupported).


This text (a) is ignorant about how the SSL&TLS version negotiation is
supposed to work and (b) gives a blessing to version-intolerant servers.

It hurts to see such text in a proposal whose purpose is to ask servers
to mitigate dangerous client behaviour.  Client behaviour that was invented
to compensate for the failure of TLS servers to properly negotiate SSL&TLS
protocol versions in combination with server's protocol version intolerance.


-Martin