Re: [TLS] Protocol version for inappropriate_fallback alerts (was: Re: I-D Action: draft-ietf-tls-downgrade-scsv-01.txt)

[Bodo Moeller <[e-mail]>]

Martin Rex <[e-mail]>:

>> +     [...] the inappropriate_fallback alert, like any
> >> +     other fatal alert this early during the handshake, should use
> >> +     a record layer protocol_version that the client can reasonably
> >> +     be expected to understand, [...]
>

> [...] Your proposed wording sounds very vague.
>


> It is vague on purpose, because it is supposed to be non-normative.
> Why would you want to inconvenience existing implementations
> (where the record level protocol version for an alert might get determined
> at the record protocol layer, and _not_ in function (as function parameter)
> that triggers the alert response, such as:
>
>    ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_INAPPROPRIATE_FALLBACK);
>

In that case, I think we should be saying nothing in the server behavior
section at all (after all, alerts sent by the client in response to the
Client Hello aren't new). Rather, the client server behavior section should
point out that clients that want to detect the inappropriate_fallback alert
must be prepared to see any record-layer protocol version.

Florian, I'd put in explicit guidance on the record-layer protocol version
to use with the inappropriate_fallback alert at your request. What do you
think about explicitly asking the client to tolerate any version (as the
TLS RFC does for the Client Hello record version) vs. explicitly telling
the server what to use?

Bodo