Re: [TLS] Call for acceptance of draft-moeller-tls-downgrade-scsv

[[e-mail] (Martin Rex)]

Yoav Nir wrote:
> 
> I'm not opposed to this document, but we should be realistic as to what 
> this solution can accomplish.
> 
> Also, older servers will not recognize the SCSV and ignore it. So to 
> have this extension add any value, all of the following much be true:
>   - an updated server
>   - an updated client
>   - Something that causes the negotiation to fail. This something could 
> be the client, the server, or something in between. The goal of this 
> extension is to catch the something in the middle.

You're missing an even more important pre-requisite.

This SCSV will only provide any value for application clients that are
actually implementing a reconnect fallback logic at the application
level.  A fallback reconnect can not be transparently implemented
by a TLS implementation, because it requires a seperate and new connection
to be established, and any application-level protocol handshakes
(such as a HTTP CONNECT proxy traversal or the application protocol
exhanges that happen before and include "STARTTLS".

The vast majority of programmatic TLS clients does still does not have
any reconnect fallback logic, and would have zero benefits from this
proposal.

A modified extension that allows the server to continue the handshake
with a TLSv1.2 ServerHello, could be processed transparently within
the TLS client implementation and provide immediate benefits to TLS clients
that do not have any application-level reconnect fallback.


What you also have to keep in mind is that the reconnect fallback that
has been implemented&shipped was quite brittle/flaky, and reconnect
fallbacks often happen unnecessarily because of bugs in the clients
connection handling (keep in mind that this is app-level reconnect
fallback logic, since this can not be transparently hidden within TLS):

  https://bugzilla.mozilla.org/show_bug.cgi?id=450280#c3


I know that Microsoft Internet Explorer has similar problems in its
client-side app-level connection state handling, which can already cause
connection failures (and white pages/frames).


-Martin