Re: [TLS] SCSVs and SSLv3 fallback

["Yngve N. Pettersen" <[e-mail]>]

On Sat, 06 Apr 2013 06:41:33 +0200, Trevor Perrin <[e-mail]> wrote:


>> The danger is that by using an SCSV we might "fix" the problem for one  
>> group
>> of users, and completely break SSL/TLS for another group of users
>
> Suppose the SCSV is only allowed in the specific case of an SSLv3
> fallback where an extension response is required or the connection
> will fail (due to a requirement for TACK, CT, or OCSP).
>
> In this case, it can't break anything because the connection is
> already going to be broken.  It's not guaranteed to work, but there's
> evidence it might.
>
> Does that address this concern?

No, it does not.

The reason it does not, is that once the client have fallen back to SSL v3  
due to version and/or extension intolerance in the server and/or the  
middleboxes you can either use a plain SSL v3 or a SSL v3 with the  
proposed SCSVs.

Assuming a plain SSLv3 does not work, then the SCSV will not work either.

OTOH, if the the plain SSLv3 works OK, we do not at present know if the  
SCSV variant will work in all cases. even if the SCSV is passed through,  
we do not know if the Server Hello extension will be passed through on the  
way back.

So, using an SCSV in the SSL v3 handshake do risk breaking a handshake  
that would otherwise have completed.

I have no idea how likely that problem is, but as Nikos pointed out, this  
is trying to accommodate bugs in implementations, but we don't have a  
complete list of the bugs that have been created in these implementations.

>> Bottom line: Assume that Murphy's Law applies; if something can be done
>> wrong, then somebody will do it wrong. And in terms of these  
>> middleboxes,
>> somebody have, but we don't know how many ways they have done it wrong.
>
> Sure.  What data do we have?
>
> Does the estimate of 1/1000 connections between (TLS-capable clients
> and servers) getting an SSL3 fallback seem right to you?

Actually, the numbers I have been informed of is that the number of  
completed connections forced to SSLv3 is less than half that.

The number of affected renego patched *servers* in my sample is in the  
0.2% range IIRC, but number of server does not translate to actual usage  
in number of connection by users. The much lower fraction of downgraded  
connections indicate that the servers I've detected are not frequently  
accessed. (BTW, the total number of intolerant servers is about 1.5%, most  
of them not renego patched).

> Do you have any idea how much of that is general network problems vs.
> middlebox problems?

All the discoveries about this problem have been made by Google.

I know Google was considering doing some tests to try to ferret out how  
much of the problem was due to middleboxes or the servers, but I do not  
know if they have done so yet, or what the results were, if they did.

-- 
Sincerely,
Yngve N. Pettersen

Using Opera's mail client: http://www.opera.com/mail/