Re: [TLS] One approach to rollback protection

[Martin Rex <[e-mail]>]

Eric Rescorla wrote:
> 
> Hmm... What's the advantage of something this complicated/expressive,
> especially given that there is no way to currently express
> "I speak TLS 1.2 but not 1.0"?

I know that with "current TLS version negotiation" it is not possible
to convey the exact protocol version that a clients supports or may
want to talk.

The issue with the original scheme is, that in order to offer TLSv1.2,
you MUST (de facto) implement *ALL* prior protocol versions.
But that currently means that you have to take all existing specs,
put them side-by-side and work out the diffs yourself, because
successors specs don't show the PDUs and semantics of previous
protocol versions side-by-side.


> 
> My objective here isn't to replace the TLS version negotiation mechanism
> but merely to remove the downgrade attack problem. If we get that right,
> and there is WG interest in revamping the version system, we can do that at
> some other time.

I don't think that revising the TLS version negotiation yet another
time is a sensible idea.  If we do it at all, make it right this
time.

It is really much more important to do the interop testing before
implementations of this are shipped, than making it the most
simplistic change possible in order to obtain a protected negotiation.

-Martin