Re: [TLS] Downgrade protection, fallbacks, and server time

[David Benjamin <[e-mail]>]

On Thu, Jun 2, 2016 at 6:40 AM Hubert Kario <[e-mail]> wrote:

> On Wednesday 01 June 2016 22:29:06 David Benjamin wrote:
> > In case folks hoped we could bump the ClientHello version without
> > those dreaded browser fallbacks, I have bad news. :-( 1.3 intolerance
> > very much exists. (Maybe we should just give up on
> > ClientHello.version and use an extension? Extensions have rusted
> > less.)
> >
> > I picked a large list of top sites and tried connecting to them. Just
> > under 2% of them could handle a TLS 1.2 ClientHello, but not the same
> > ClientHello with the version switched to 1.3 (no other changes, so I
> > haven't tested a real 1.3 ClientHello). They're not unknown hosts
> > either. I expect if you probe any top site list, you'll very quickly
> > find some.
>
> there are also servers which choke on large extensions (say 4096 bit DH
> client key share with 384 bit ECDH key share), so avoiding the bump in
> version number won't solve all the problems either...
>

TLS 1.3 doesn't require clients offer a KeyShare for all groups in the
first ClientHello. It costs a HelloRetryRequest and another round-trip, but
I think that's fine. Clients can limit FFDHE in the initial ClientHello to
servers they've spoken to before or something. For unknown servers, if you
only predict a couple of EC groups, it shouldn't blow it up too badly, but
of course we'll just have to see.

(Or clients can just not bother with FFDHE to begin with. I don't see the
point and am not very interested in implementing it at all.)


> Speaking of version number, does the text say that a server _MUST_
> accept any version higher than the one that is specified in the RFC, but
> reply with 0x03,0x04 in case it doesn't support any future version of
> the protocol? It would be nice to have some kind of stick for the broken
> implementations...
>

I'm not sure I follow. The specification certainly spells out how version
negotiation is supposed to work. That hasn't stopped servers from getting
it wrong. Fundamentally this is the sort of thing where bugs don't get
noticed until we make a new TLS version, and we don't do that often enough
to keep rust from gathering.

David