Re: [TLS] Deprecating SSLv3

[Stephen Checkoway <[e-mail]>]

On Nov 10, 2014, at 6:17 PM, Martin Thomson <[e-mail]> wrote:

> Richard, Alfredo, Adam and I have proposed such a statement:
> 
> https://datatracker.ietf.org/doc/draft-thomson-sslv3-diediedie/

Is there any harm associated with having 03 00 in the record layer? It seems like the three statements you want are:

1. The client MUST NOT send a ClientHello with ClientHello.client_version set to { 3, 0 }.
2. The server MUST NOT send a ServerHello with ServerHello.server_version set to { 3, 0 }.
3. If the client receives a ServerHello with ServerHello.server_version set to { 3, 0 }, the client MUST send a "protocol_version" alert message and close the connection.

I think these three are sufficient to forbid negotiating SSLv3 and the advice given in Appendix E still applies:

   TLS clients that wish to negotiate with older servers MAY send any
   value {03,XX} as the record layer version number.  Typical values
   would be {03,00}, the lowest version number supported by the client,
   and the value of ClientHello.client_version.  No single value will
   guarantee interoperability with all old servers, but this is a
   complex topic beyond the scope of this document.

1 isn't necessary as long as you have 3, but it seems pointless to have ClientHello.client_version = { 3, 0 } and then close the connection.

The current draft seems to allow the following two scenarios where the client adheres to the draft but the server does not.

Scenario I:
TLSPlaintext.version = { 3, 1 }
ClientHello.client_version = { 3, 0 }
ServerHello.server_version = { 3, 0 }

Scenario II:
TLSPlaintext.version = { 3, 1 }
ClientHello.client_version = { 3, 1 }
ServerHello.server_version = { 3, 0 }

The first scenario is pretty unlikely (why would the client be compliant with the draft but have a maximum version of SSLv3?) but would seem to work with a TLSv1.2 server that was willing to negotiate SSLv3.

The second scenario seems more likely with a SSLv3 server (which accepts 03 xx in the record layer).

Maybe I'm missing something that rules those two cases out. But even if so, a clear MUST NOT regarding the client_version and server_version and a MUST on the protocol_alert if the server wants SSLv3 seems better overall.

-- 
Stephen Checkoway