Re: [TLS] Cipher suite values to indicate TLS capability

[Adam Langley <[e-mail]>]

On Fri, Jun 8, 2012 at 6:08 PM, Nikos Mavrogiannopoulos <[e-mail]> wrote:
> It may not be true, but what would you do if the SCSV check fails?
> Wouldn't you warn the user?

We would either go back to TLS, or return the original network error
that caused the fallback. We're not going to try telling the user that
they "may be under attack" or such.

> Most probably he'd say that your browser doesn't work. Let's
> try the other one (which doesn't support SCSV and thus wouldn't detect a
> possible attack).

That's always a possibility but the argument that users will try other
browsers, while true, is also true of many other changes that we've
made: rejecting tiny EDH groups, rejecting RSA keys < 1024-bits,
rejecting MD4 and MD5 signatures. With each of these we have,
undoubtedly, lost users to browsers that don't implement these things.
But we have also motivated people to fix things and provided cover for
other browsers to make the same changes. This tension between breaking
things for the common good and keeping users happy always exists in
large software and I know that this proposal, even for just SSLv3,
will break users behind a certain vendor's firewall product. But
that's a cost to be balanced rather than a fatal flaw (and I'm already
taking to that vendor).

> What if a new server comes out that the SCSV fails for some
> random reason?

Once we start to use the SCSV, we draw a line in the sand and it's
much less likely that there will be compatibility problems in the
future.

> I agree that it helps to mitigate some problem, but my
> concern is, does any gain obtained justify the introduced protocol
> complexity?

Well, the complexity decision depends substantially on an individual's
preferences. I obviously believe that this is worthwhile: the SCSV is
a relatively minor addition and the downgrade attack is real. But from
my point of view the protocol is already subject to several of these
warts [1] that the specified protocol doesn't include. This would be a
rather obvious wart on the spec, even if it's not so big compared to
my reality.

[1] http://www.imperialviolet.org/2011/02/04/oppractices.html


Cheers

AGL