Re: [TLS] Call for acceptance of draft-moeller-tls-downgrade-scsv

[Rob Stradling <[e-mail]>]

On 23/01/14 18:14, Adam Langley wrote:
> On Thu, Jan 23, 2014 at 1:07 PM, Kurt Roeckx <[e-mail]> wrote:
>> I think the document starts from the assumption that there is
>> someone in the middle that can alter the data, and then let the
>> client do a downgrade.  What is stopping this attacker from
>> removing this scsv from the client hello?
>
> The Finished messages will detect any manipulation of the handshake.
>
> The key to the draft is that we believe that no servers will be
> intolerant to the SCSV, and thus clients can always send it when doing
> a fallback.

Adam, I wonder if [1] is relevant here.  Apparently some servers ignore 
the most significant byte of each cipher suite value sent by the client.

Those servers would presumably interpret...
   TLS_FALLBACK_SCSV          {0x56, 0x00}
...as...
   TLS_NULL_WITH_NULL_NULL    {0x00, 0x00}

I guess the chances of a server actually having TLS_NULL_WITH_NULL_NULL 
enabled and choosing to select it above all other mutually supported 
ciphers is pretty remote.  But nonetheless, is there any reason why 
TLS_FALLBACK_SCSV couldn't have a value of, say, {0x00, 0xFE} ?


[1] https://bugzilla.mozilla.org/show_bug.cgi?id=946147

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online