Re: [TLS] A new consensus call on ALPN vs NPN (was ALPN concerns)

[Bill Frantz <[e-mail]>]

On 12/11/13 at 3:59 PM, [e-mail] (Brian Smith) wrote:

>On Wed, Dec 11, 2013 at 11:14 AM, Bill Frantz <[e-mail]> wrote:
>>We should not insist that a client using the new protocol be able to connect
>>of a tls 1.2 server (or below) as a result of tls level negotiation. The
>>fallback mechanisms in most browsers can cover that need. The extra design
>>freedom will allow us to easily encrypt data that was previously sent in the
>>clear without worrying about backward compatibility.
>
>I think us browser people might have unintentionally misled people
>about our eagerness to reconnect with downgraded security properties.
>I, and other browser people I know, consider it mis-feature, and we'd
>love to find a way to stop doing it. So, trying to connect via "TLS
>2.0" that has better security/privacy properties, and then insecurely
>falling back to TLS 1.2 with worse security/privacy properties, is
>something that I'd definitely want to avoid.

Obviously, considering the code that is now being shipped, most 
browser people have held their noses and gone down the retry at 
lower level path. Functionality over the best security.

Of course until quite recently people thought that SSL3 was 
reasonably secure, so the odor wasn't quite as bad.


>...
>
>Besides being an ineffective security/privacy measure (since any MitM
>could induce the fallback to from "TLS 2.0" to TLS 1.2), it would also
>be unacceptable due to the added latency for any site that hadn't
>upgraded to "TLS 2.0." We are many years away from that becoming a
>viable thing for us to do.

I view the added latency as a plus. It gives sites an incentive 
to upgrade.

<rant>
We are now in the situation where much of the end-user security 
software is automatically upgraded regularly. The server side 
software is never* upgraded. To improve net security this 
situation has to change.

* Yes, it's a bit strong. Google, Facebook etc. are leaders in 
improving security. However, never applies to the embedded 
devices using HTTPS for configuration.
</rant>

Cheers - Bill

-----------------------------------------------------------------------
Bill Frantz        | If the site is supported by  | Periwinkle
[phone]      | ads, you are the product.    | 16345 
Englewood Ave
www.pwpconsult.com |                              | Los Gatos, 
CA 95032