Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

[Manuel Pégourié-Gonnard <[e-mail]>]

On 16/10/2014 16:04, Nikos Mavrogiannopoulos wrote:
> On Thu, 2014-10-16 at 15:48 +0200, Manuel Pégourié-Gonnard wrote:
> 
>>> A widely-deployed client might use TLS 1.2 with FALLBACK_SCSV 
>>> unconditionally.  This client would break once servers start supporting 
>>> TLS 1.3.  That's just one example of what could go wrong which could not 
>>> go wrong before.
>>>
>> I'm sorry, but wouldn't that be very stupid of the client? Maybe the draft could
>> include wording that clients MUST NOT do that, to be extra clear, but IMHO it's
>> already quite clear.
> 
> Of course, but isn't this issue that SCSV is trying to fix in the first
> place? Isn't the SCSV's reason of existance the fact that there are some
> buggy servers that cannot handle TLS protocol version negotiation? Why
> should we assume that buggy clients are impossible to happen?
> 
That's probably a good argument for mentioning it explicitly in the spec.

Maybe also mention that TLS implementations must not include this SCSV unless
explicitly requested to do so by the application, to prevent false good ideas
such as "let's include FALLBACK_SCSV automatically when the version we're
offering is less than the highest version we support" (which also should be
clear by reading the spec, but who knows).

I might be overly optimistic, but I hope that people implementing client
work-arounds made necessary by the existence of buggy servers are able and
willing to correctly implement a short a simple spec without adding bugs.

Manuel.