Re: [TLS] 2nd WGLC: draft-ietf-tls-downgrade-scsv

[Brian Smith <[e-mail]>]

Martin Rex <[e-mail]> wrote:
> Brian Smith wrote:
>> Sean Turner <[e-mail]> wrote:
>>> This message initiates the 2nd WGLC for draft-ietf-tls-downgrade-scsv-02.
>>> Please review the document and send your comments to the list by Friday,
>>> December 12, 2014.
>>
>> The text in the draft should be changed to read something like
>> "Clients SHOULD put the TLS_FALLBACK_SCSV after all cipher suites that
>> the client actually intends to negotiate."
>
> That is silly.

This suggestion is based on implementation experience, known
interoperability issues, and testing that has been already reported on
this list and on the openssl-dev list.

> I don't think there is such a weird recommendation in rfc5746.

Apparently, there is not yet evidence that RFC5746 has similar problems.

>> Recently, it has been shown that it is problematic to put the
>> TLS_FALLBACK_SCSV cipher suite ahead of any real cipher suites in the
>> ClientHello, because doing so causes unintended handshake failures.
>
> This statement is self-contradictory.
>
> The entire and only purpose of this I-D is to cause handshake failures,

That is true, but *only* in a specific set of circumstances. The
problem is that handshake failures occur in other circumstances where
the draft does not prescribe a failure.

Cheers,
Brian