Re: [TLS] Working Group Last Call fordraft-ietf-tls-downgrade-scsv-00

[Rob Stradling <[e-mail]>]

On 20/10/14 18:30, Brian Smith wrote:
> On Mon, Oct 20, 2014 at 4:53 AM, Martin Thomson wrote:
<snip>
>     I think that we should do that, but as a practical matter, I suspect
>     that we'll be stuck with some amount of fallback for a while yet.  I
>     find the TLS 1.3 intolerance numbers pretty alarming in this regard;
>     even with rapid improvement, I doubt it will go away quickly.
>
> That's why the version negotiation mechanism for TLS 1.3 should be
> different. We've already made the mistake 3 times of trying to use
> ClientHello.client_version to negotiate versions and 3 times we've
> learned that it has terrible compatibility issues. Why keep repeating
> that same mistake? By negotiating TLS 1.3 with a new extension, and
> keeping ClientHello.client_version = TLS 1.2 for TLS 1.3, you avoid the
> compatibility costs without losing anything.

How about negotiating TLS 1.3 using yet another new SCSV?

Yes, I know, that'd be even more of a hack than negotiating TLS 1.3 with 
a new extension.  But since server-side support for extensions is 
optional, and since there are servers out there that are 
extension-intolerant, I figured I should at least suggest the idea.  ;-)

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online