Re: [TLS] An SCSV to stop TLS fallback.

[Daniel Kahn Gillmor <[e-mail]>]

On 12/06/2013 01:25 PM, Martin Rex wrote:
> So the use of the TLS_FALLBACK_SCSV will either *NOT* affect the rest
> of the TLS protocol not at all, or cause a fatal handshake failure.
> And very few, if any at all, of the situations where the handshake fails,
> will be instances of an active attack.

This is probably also true of X.509 certificate validation failure as
well, since there are more self-signed or expired certificates in active
use than there are active MITM attackers.  Are you suggesting that TLS
would be better off not checking certificate validity?

> And it remains extremely
> questionable, when the handshake would succeed, that the attacker
> will gain anything at all.

What the attacker can gain presumably depends on what features the
client is willing to sacrifice during fallback.  Presumably, the client
gives up specific features of the newer versions: e.g. AEAD, when
falling back below TLS 1.2, or possibly all TLS extensions for fallback
all the way to SSLv3 (to accomodate old extension-intolerant SSLv3 servers).

It looks like you're saying that none of these more modern features are
useful tools in defending against an active attacker.  Do you really
think that?

	--dkg