Re: [TLS] An SCSV to stop TLS fallback.

[Brian Smith <[e-mail]>]

On Mon, Nov 25, 2013 at 3:27 PM, Adam Langley <[e-mail]> wrote:
>   In the event that a client is making a fallback connection, it
> includes TLS_FALLBACK_SCSV (0x5600) in the list of cipher suites. A
> current server which sees this cipher suite in a ClientHello SHOULD
> return a fatal alert, inappropriate_fallback (86) and abort the
> connection.

Adam, I think what you propose makes sense. However, I think it might
not be ideal if there are any circumstances where the browser could
accidentally fall back to a lower version--e.g. falling back after a
timeout or falling back in response to the connection being reset.
AFAICT, we currently have to do fallback from TLS 1.2 -> TLS 1.1 and
from TLS 1.1 -> TLS 1.0 in response to connection resets. There will
be some false positives here. In addition to potentially reducing the
security of the connection, these fallback connections add a lot of
latency. If we attempt a fallback connection in response to a
connection reset, and we receive an inappropriate_fallback alert, then
we'd have to make yet *another* connection without the fallback. All
other things being equal, it would be better if the server could
respond respond exactly as it would with a TLS 1.2 ClientHello,
without downgrading the cipher suite or any other feature, more like
what Martin Rex suggested.

However, I don't think it is realistic to backport features all the
way to SSL 3.0. The information in the TLS extensions is too
important, and trying to define good defaults for missing extensions
that make sense long-term seems like it will just bind our hands too
much in the future.

So, we should could consider backporting TLS 1.2 cipher suites to TLS
1.1 and TLS 1.0, but then using your suggested inappropriate_fallback
for for SSL 3.0 handshakes only.

Whether this complication is justified depends on how frequently we
receive false-positive connection resets (and anything else that can
be a false positive) and how much we care about optimizing performance
for that case.

Cheers,
Brian
-- 
Mozilla Networking/Crypto/Security (Necko/NSS/PSM)