Re: [TLS] One approach to rollback protection

[Marsh Ray <[e-mail]>]

I agree that the current semantics are starting to feel a bit silly. 
Support for TLS 1.2 also implies a willingness to speak SSLv3?
Are we expecting to continue this forever?

On 09/26/2011 07:21 PM, Martin Rex wrote:
>
> My personal favourite would be to use an OR'ed bitmask, and we could
> either "waste" a whole 256 cipher suite codepoints (or be more conservative
> and require the reserved bits below to be all ZERO--requiring
> only 16 cipher suite code points starting at a block boundary).
>
>      version_major  = 0xYY (assigned/reserved by IANA as { 0xYY, * } )
>      version_minor  = a set of 8 bits indicating TLS version offered by client
>
>       x80|x40|x20|x10|x08|x04|x02|x01   Value
>        7 | 6 | 5 | 4 | 3 | 2 | 1 | 0    Bit Position
>
>        |   |   |   |   |   |   |   |
>        |   |   |   |   |   |   |   |
>        |   |   |   |   |   |   |   `-  indicates SSLv3   support {0x03,0x00}
>        |   |   |   |   |   |   `-----  indicates TLSv1.0 support {0x03,0x01}
>        |   |   |   |   |   `---------  indicates TLSv1.1 support {0x03,0x02}
>        |   |   |   |   `-------------  indicates TLSv1.2 support {0x03,0x03}
>        |   |   |   `-----------------    (reserved for TLSv1.3)
>        |   |   `---------------------    (reserved for TLSv1.4)
>        |   `-------------------------    (reserved for TLSv1.5)
>        `-----------------------------    (reserved for TLSv1.6)

But the current cipher suite negotiation is already a set. Why not just 
have one cipher suite value for each version and burn only 4 or so code 
points rather than 256?

On 09/26/2011 08:14 PM, Eric Rescorla wrote:
 > In an environment where the client could indicate any combination of
 > versions, the impact of implementing TLS 1.2 only would be that a
 > server which did not support TLS 1.2 would generate an error instead
 > of a ClientHello. [ServerHello?]
 >
 > Since servers are supposed to select the highest common version, I'm
 > not sure I see serious difference between these two.

The difference is that somebody will look at Wireshark and instead of 
seeing random disconnects and thinking they're the subject of some 
low-level DoS attack, they'll see a bright yellow line that reads:
"TLS Alert: Endpoints support no common protocol version."

- Marsh