Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

[Bodo Moeller <[e-mail]>]

Andrey Jivsov <[e-mail]>:

The reality of the Internet today is that TLS 1.1 is viewed as acceptable.
> Clients treating TLS 1.1 treating it this way too. The draft *requires* to
> introduce a rejection of TLS 1.1 connection on the server when the server
> detects the downgrade.
>

According to the draft, this server-side rejection is REQUIRED *if the
client sent TLS_FALLBACK_SCSV to request it*. For the client, however, it
is merely RECOMMENDED to send TLS_FALLBACK_SCSV in all fallback retries.

My point is that downgrades from TLS1.0 to SSL3.0 is one thing but from
> TLS1.3 to TLS1.2 is another.


You appear to be saying that, carefully weighing the case, a silent
fallback to TLS 1.2 can be acceptable. I don't disagree: the spec takes
this into account, it's just that it leaves it to the *client* to make this
decision, without further *server*-side heuristics interfering with it,.

(I think this makes sense because it's the client that decides whether to
do fallback retries in the first place. For clients that don't set
TLS_FALLBACK_SCSV at all, for example, any server-side enabled protocol
version can be negotiated anyway -- the server can't avoid using old
versions with such clients other than by disabling them entirely.)

Bodo