[TLS] Viability of fallback SCSV and padding drafts.

[Adam Langley <[e-mail]>]

Chrome 33 went stable[1] on the 20th and contained implementations of
both the fallback SCSV[2] and padding drafts[3]. The fallback SCSV is
also enabled for Google properties.

Of the two, padding was significantly more trouble. In order to flush
out problems, Chrome 33 pads all ClientHellos to 512 bytes, whether
they would have been smaller than 256 bytes or not.

One, Windows based, "anti-virus" product broke because it made
assumptions about the maximum size of a ClientHello. One network
middleware product broke for the same reasons.

Both have now been updated. (Thankfully, the design of the network
middleware was such that it could be updated for all users.)

A second, "anti-virus" product also broke, Kaspersky, and it's unclear
which of the two changes caused the problem. Kaspersky has a history
of such issues but the TLS MITM mode is disabled by default and this
has not been a major source of user feedback.

It's possible that smaller breakages have also occurred but I've seen
no evidence of that yet. We continue to follow up on user reports in
case there's something that got missed.

We're going to change Chrome 33 to only pad ClientHellos when needed,
but that's the only change scheduled so far. Otherwise both changes
are holding steady and appear viable.


Cheers

AGL


[1] http://googlechromereleases.blogspot.com/2014/02/stable-channel-update_20.html
[2] https://tools.ietf.org/html/draft-bmoeller-tls-downgrade-scsv-01
[3] https://tools.ietf.org/html/draft-agl-tls-padding-03