Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

[Bodo Moeller <[e-mail]>]

"Martin Rex" <[e-mail]>:

> I'm also strongly opposed to this proposal, because it does not provide
> any value--there is not one single *additional* TLS handshake that it
> will make succeed,
[...]

> The "downgrade-scsv" has the effective semantics of
> "kick me if you can read this", which is pretty silly on my scorecard.
>
>
> A reasonable alternative SCSV would have the semantics
> "Dear Server, I'm a new, full-featured client and would really like
> to send you a full-featured ClientHello, but didn't dare doing as
> the first message on the connection because of all the old broken
> servers out there which choke on feature-rich ClientHellos".
>
> And a new Server's response to such an SCSV should be to
> respond with a ServerHello+ServerHelloDone which carries the SCSV
> in the ServerHello.cipher_suite = SCSV, which the client will
> recognize and understand as an invitation to send the desired
> full-featured ClientHello (on the very same existing connection
> transparently).

Improving interoperability per se certainly is not a goal of our spec
(instead, it's all about breaking interoperability with attackers if you
will).

That doesn't mean that avoiding the need for fallback retries isn't a
worthy goal, it just is completely orthogonal to what TLS_FALLBACK_SCSV
does. We give you a spec that you can deploy right to gain actual security
advantages (unless your clients never do fallback retries), where the
solution you sketch would be much more involved.

Once anything like what you propose gets successfully rolled out, there
would be no more need to send our SCSV, and the (simple!) server-side logic
would then lie dormant. However I think it's pretty clear that that day is
still pretty far away -- certainly far enough to warrant taking other
measures of protection.

Your claim that TLS_FALLBACK_SCSV
"does not provide any value" appears blatantly untrue, unless you don't
recognize preventing demonstrated attacks as "value".

Bodo