Re: [TLS] SCSV vs RI when both specified - consensus?

[Michael D'Errico <[e-mail]>]

Marsh Ray wrote:
> 
> Is everybody OK with this wording? (it's the more lenient choice):
> 
>> Clients MUST NOT put multiple occurrences of an RI extension in the
>> same Client Hello message. A client MAY specify the SCSV in the same
>> Client Hello message as an RI extension (the SCSV will be effectively
>> ignored).
>>
>> A server receiving a Client Hello containing multiple RI extensions
>> MUST generate a fatal "decode_error" alert and terminate the
>> connection. A server receiving a Client Hello containing the SCSV
>> and an RI extension is to interpret the RI as usual and ignore the
>> SCSV.

As Nasko pointed out, we don't need to talk about multiple RI extensions.
So this could collapse into something like:

   Clients MAY send SCSV in all ClientHellos, even when also sending
   an RI extension (either empty or containing data).  Servers MUST
   ignore SCSV when the client has also sent RI.

> We'll have to fix the conflict with the current:
>> This SCSV is not a true cipher suite and cannot be negotiated. It
>> merely has exactly the same semantics as an empty "renegotiation_info"
>> extension.
> 
> to something like:
>> This SCSV is not a true cipher suite and cannot be negotiated, it
>> has similar semantics as an empty "renegotiation_info" extension.

Perhaps:

   This SCSV is not a true cipher suite and cannot be negotiated; a
   server that encounters SCSV but not RI MUST proceed exactly as if
   an empty RI extension had been received.

Mike