Re: [TLS] Fallback SCSV summary

[Bodo Moeller <[e-mail]>]

Thanks for the comments!



> "The fallback SCSV defined in this document is not suitable substitute for
> proper TLS version negotiation. TLS implementations need to properly handle
> TLS version negotiation and extensibility mechanisms to avoid the security
> issues and connection delays associated with fallback mechanisms."
>

Added to the introduction (but s/fallback mechanisms/fallback retries/).


"If the client receives an inappropriate_fallback alert then the server
> intends to support a higher version and the client should retry with the
> highest version it supports.   Implementors should review the security
> considerations section before deciding to make a connection with a lower
> version without including the TLS_FALLBACK_SCSV.
>

Added to Section 4:

" [...] SHOULD include the TLS_FALLBACK_SCSV cipher suite value in
ClientHello.cipher_suites; see Section 6 for security  considerations for
this recommendation."

and

"Fallback retries could be caused by events such as network glitches, and a
client including TLS_FALLBACK_SCSV in ClientHello.cipher_suites may receive
an inappropriate_fallback alert in response, indicating that the server
supports a higher protocol version. Thus, if a client intends to use
retries to work around network glitches, it should then retry with the
highest version it supports."



> [...] However, it is important to remember that omitting the
> TLS_FALLBACK_SCSV leaves the TLS connection vulnerable to version rollback
> so it is not recommended to omit the SCSV unless the negotiated version
> provides an acceptable level of protection.
>

Added to Security Considerations:

"It is important to remember that omitting TLS_FALLBACK_SCSV enables
downgrade attacks, so implementors must take into account whether the
protocol version given by ClientHello.client_version still provides an
acceptable level of protection."


3.  The introduction should indicate that the Fallback SCSV also applies to
> DTLS.
>

New wording in the introduction:

"This specification applies to implementations of TLS 1.0 [RFC2246], TLS
1.1 [RFC4346], and TLS 1.2 [RFC5246], and to implementations of DTLS 1.0
[RFC4347] and DTLS 1.2 [RFC6347]."



> 4.  The IANA considerations section needs to allocate the number for the
> alert:
>

Oops, good point. Done.

Bodo