Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

[Bodo Moeller <[e-mail]>]

Andrey Jivsov <[e-mail]>:

To be even more specific, let's simplify the above a bit:
>
>        TLS1.2: X, Y

[...]

> If you accept that this is allowed on the server, for the purpose of the
> draft what's the server's maximum protocol version?
>

Very clearly it is TLS 1.2, but I'll make it clearer in the next version of
the I-D to avoid any ambiguity.

Note that in fallback retries, clients might omit cipher suites (that don't
work with the older protocol version).  We don't want to the server to try
to be clever then and say "Well, this Client Hello doesn't look a fallback
after all because I only support these ciphers with older protocols".



> [...] However, this results in odd behaviour when the server is required
> to fail fallback handshakes with versions that are more secure than it
> could negotiate if TLS_FALLBACK_SCSV was not present.
>

Maybe so, but I can live with that: this is not an arbitrary restriction,
but it follows from rules that serve the purpose they are designed for, and
it does not affect servers that follow the TLS specification.

Bodo