Re: [TLS] SCSV versioning

[Bodo Moeller <[e-mail]>]

>
> I believe it's the same thing I mentioned last year, in
>
> http://www.ietf.org/mail-archive/web/tls/current/msg11208.html
>
> The implicit assumption made by the SCSV is that all new servers
> (supporting the SCSV) will not have bugs requiring a fallback.  As
> soon as that first server appears which supports SCSV but requires
> fallback, this SCSV can't be used.


This would affect fallback handshakes from *future* protocol versions to
TLS 1.2, as we've seen that it's not a problem in practice when falling
back from TLS 1.2 to earlier versions. So it could mean that clients that
want to maintain interoperability with servers that can't handle their TLS
1.3 handshake attempts might not want to send TLS_FALLBACK_SCSV in fallback
handshake Client Hello messages announcing TLS 1.2. (The document's
Security Considerations cover this, by the way.) I don't see how it could
be a reason to not use the SCSV when falling back to a version below TLS
1.2.

Bodo