Re: [TLS] An SCSV to stop TLS fallback.

[Adam Langley <[e-mail]>]

On Wed, Nov 27, 2013 at 6:40 AM, Bodo Moeller <[e-mail]> wrote:
> Writing the I-D, I realized that it would be a pity if, in case a need came
> up to implement similar fallback strategies when deploying future protocol
> versions, you'd have to wait for *another* document to specify *another*
> SCSV to be able to prevent new protocol downgrade attacks, such as from TLS
> 1.3 to TLS 1.2.  Ideally all servers implementing
> TLS_FALLBACK_SCSV/TLS_DOWNGRADE_SCSV would be fully version tolerant, but
> obviously tolerance for *future* protocol versions is not a server feature
> normally exercised in practice -- so to cope with the "Universal Rule of
> Users", we'll have to assume that some servers may be around that aren't
> fully version tolerant, while working perfectly as far as said Users are
> concerned.  Hence the server logic to compare the client's protocol version
> to the server's supported protocol version: if the client is falling back to
> the server's highest supported protocol, that's not a malicious protocol
> downgrade.

Ah, I understand now, thanks. That's a good point, I'll do that.


Cheers

AGL