Re: [TLS] Call for acceptance of draft-moeller-tls-downgrade-scsv

[[e-mail] (Martin Rex)]

Salz, Rich wrote:
>
>> By transmitting this SCSV, the client is saying to the server
>> "just so you know, i tried a better protocol, but it didn't work
>> -- if you meant to accept better protocols, then someone is
>> messing with us, please abort."
> 
> That's a really nice explanation.

Nope, that is a bad idea.

We know pretty damn well that there are a number of non-malicious
middle-boxes all over the place on the internet.  They're the
reason that the fallbacks to overcome handshake failures were invented
in the first place.

If you either believe that giving those middle-boxes a hard time
and giving the end users a hard time and forcing the user
to use cleartext HTTP is desirable, then simply disable the
fallback on the client and be done with it -- this will reliably
work with every existing server out there.


But if instead, after having pestered enough of your users/customers,
you figure that you need to enable succeding with TLSv1.0 instead
of forcing the user to switch to cleartext-HTTP, then you will
need yet another level of fallback, to a ClientHello without that
SCSV -- at which point this whole effort turns into a complete waste.



Now on top of that, we do know that TLSv1.2 is cryptographically
weaker than TLSv1.0 and TLSv1.1 because of the weak default SHA1-only
digitally-signed with RSA server certificates.


I would really appreciate if this Working Group would spend more
time on making more TLS handshakes succeed and make strong
algorithms and cipher suites more easily achievable for the
huge installed base of TLS that is under software maintenance.


-Martin