Re: [TLS] An SCSV to stop TLS fallback.

Andy Wilson <andrewgwilson@gmail.com> Tue, 26 November 2013 00:52 UTC

Return-Path: <andrewgwilson@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3B6A31AE0DE for <tls@ietfa.amsl.com>; Mon, 25 Nov 2013 16:52:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1BqNbr77-gnb for <tls@ietfa.amsl.com>; Mon, 25 Nov 2013 16:52:34 -0800 (PST)
Received: from mail-bk0-x233.google.com (mail-bk0-x233.google.com [IPv6:2a00:1450:4008:c01::233]) by ietfa.amsl.com (Postfix) with ESMTP id 3247F1AE0C8 for <tls@ietf.org>; Mon, 25 Nov 2013 16:52:34 -0800 (PST)
Received: by mail-bk0-f51.google.com with SMTP id 6so2265089bkj.38 for <tls@ietf.org>; Mon, 25 Nov 2013 16:52:33 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=QQkiPg8+29ZYxbFEwSWBjZXlZ+DRf7kD3UcmcVkmN7E=; b=epTpmJJcB1kF7FYpyZV7u32PLDwufgeQE0+eR6ks/DWTPe7qMWSQeLLUSB/b53adhA vGQ09sAFndH1A3x2nffZkH/GWgU0+Y/GW6vsj0us/6l5cBBOycZW34mIjpEQdU5QANHZ 6q4TPoW2H0U+qk6Ey39Oah06EyRT9fPrPDY9XL4vzxfzhYmwZHvHmjNxkvcpOvN2XaGg NppW5Wrv8Oqut1BlHOi88RRc5Nkb/Mzoed0B5jBLRpXM0kWJCTGRRl9PvLY4ZQlj4kZo UJv37LAGCDtX3WyORUHhc5lAG7v4JtBKuzDvNugdgTH8/wuW4prLINROaFW3C9UVpTp9 3uqA==
MIME-Version: 1.0
X-Received: by 10.204.103.199 with SMTP id l7mr25799432bko.11.1385427153682; Mon, 25 Nov 2013 16:52:33 -0800 (PST)
Received: by 10.205.18.193 with HTTP; Mon, 25 Nov 2013 16:52:33 -0800 (PST)
In-Reply-To: <CAL9PXLxueY_k0XWgTrqVxqXDgvCRhAW5UEa8YjU9_rnuZ6otTA@mail.gmail.com>
References: <CAL9PXLzWPY5o2SeV=kUPWxznkw+3cmpbMpYifCebfqd48VW9UA@mail.gmail.com> <CACsn0ckuupJaNKXGjP63LfZiDsV5FLOqfk902O9i1oheqtAAhA@mail.gmail.com> <CAL9PXLxueY_k0XWgTrqVxqXDgvCRhAW5UEa8YjU9_rnuZ6otTA@mail.gmail.com>
Date: Tue, 26 Nov 2013 13:52:33 +1300
Message-ID: <CAL2p+8TXJVmnb-v3xH6uzW+rpZ+v8J65TjO32__O3ZofQiwSig@mail.gmail.com>
From: Andy Wilson <andrewgwilson@gmail.com>
To: Adam Langley <agl@google.com>
Content-Type: multipart/alternative; boundary=001a113351945bb42f04ec09e558
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] An SCSV to stop TLS fallback.
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 26 Nov 2013 00:52:36 -0000

I take it you're aware of
http://tools.ietf.org/html/draft-bmoeller-tls-downgrade-scsv-00


On 26 November 2013 12:52, Adam Langley <agl@google.com> wrote:

> On Mon, Nov 25, 2013 at 6:49 PM, Watson Ladd <watsonbladd@gmail.com>
> wrote:
> > If firewalls block port 53, it's not the browser's problem. If
> > firewalls block 80, it's not the browser's problem. Why should
> > TLS 1.2 be any different?
>
> Because firewalls that block (by RST injecting) TLS 1.2/1.1/etc
> connections currently work and this change would stop them working.
> Therefore it would be Chrome's fault. (This is exactly as stupid as it
> sounds, yet it is the world I live in.)
>
>
> Cheers
>
> AGL
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>



-- 
Regards

Andy