Re: [TLS] An SCSV to stop TLS fallback.

[Trevor Perrin <[e-mail]>]

On Tue, Nov 26, 2013 at 9:38 AM, Adam Langley <[e-mail]> wrote:
> On Mon, Nov 25, 2013 at 9:33 PM, Trevor Perrin <[e-mail]> wrote:
>> Are these MITM products using special root certs installed in the
>> browser for MITM purposes?
>
> Yes.
>
>> If so, could the browser simply allow
>> SSLv3 fallback only when connecting to a cert under such an installed
>> root, while otherwise rejecting such a fallback?
>
> Yes, but I don't believe that would be viable on the Internet as a
> whole. There are certainly many HTTPS servers on the Internet that
> need fallback in order to function. We would like not to break them
> while stopping them dragging everyone's security down. So we still
> need some way to identify non-broken servers.

Sure, makes sense.

There was an earlier thread about TLS-intolerant middleboxes and the
problem they pose for TLS enhancements which require TLS Extensions
(like CT, TACK, and OCSP "must-staple") [1].

Are your observations actually good news for that case?  If many of
those intolerant middleboxes that were being observed are actually
*MITM* boxes with installed MITM roots, presumably browsers could
detect when they are connecting to such a MITM middlebox, and relax
their requirements around (CT, TACK, OCSP "must-staple", etc.)?


Trevor

[1]
http://www.ietf.org/mail-archive/web/tls/current/msg09450.html
http://www.ietf.org/mail-archive/web/tls/current/msg09468.html