Re: [TLS] Final nail in the coffin for cleartext SNI/ALPN in TLS 1.3

[Bodo Moeller <[e-mail]>]

2013/11/8 Watson Ladd <[e-mail]>

 > The downgrade attack to TLS 1.2 is possible and would trigger the SNI to
> be
> > send in clear again.
> > (It requires an active attack).
> Why wasn't this fixed years ago?


This is not an easy question to answer.  (Yes, it certainly *should* have
been fixed years ago.)


> The client should indicate the
> highest offered version when falling back, and the server should
> signal if there is a problem. This was an issue with SSL 3.0 and TLS
> 1.0. It's still an issue today because SSL 3.0 is still out there.


See https://tools.ietf.org/html/draft-bmoeller-tls-downgrade-scsv-00 for a
proposal intended to be particularly simple.

(This is not the first proposal in this spirit; see, e.g.,
http://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-version-cs.txt.
 A recurring complaint is that TLS instead should promote interoperability,
which I think is not a valid complaint: While interoperability should be
better than it is, (1) this doesn't extend to interoperability with
attackers, and (2) it's a false dichotomy --
deploying draft-bmoeller-tls-downgrade-scsv-00 would deal with security
problems that arise as implementations work around interoperability
problems, but that I-D won't get in your way in any way, shape or form if
you do in fact manage to avoid those interoperability problems that
currently are often handled by version downgrades.)

Bodo