Re: [TLS] An SCSV to stop TLS fallback.

Adam Langley <agl@google.com> Mon, 25 November 2013 23:52 UTC

Return-Path: <agl@google.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 732891AE07D for <tls@ietfa.amsl.com>; Mon, 25 Nov 2013 15:52:57 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.38
X-Spam-Level:
X-Spam-Status: No, score=-1.38 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A-XPMBEFPS_z for <tls@ietfa.amsl.com>; Mon, 25 Nov 2013 15:52:56 -0800 (PST)
Received: from mail-vb0-x232.google.com (mail-vb0-x232.google.com [IPv6:2607:f8b0:400c:c02::232]) by ietfa.amsl.com (Postfix) with ESMTP id 164CA1AE024 for <tls@ietf.org>; Mon, 25 Nov 2013 15:52:56 -0800 (PST)
Received: by mail-vb0-f50.google.com with SMTP id 10so3302088vbe.37 for <tls@ietf.org>; Mon, 25 Nov 2013 15:52:56 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=jJqwopQR7oe90OganCpQr6jTXWwwiI1n+Zx7QO87OIk=; b=Q+0gOyGxei6GCfM3X7KaxZcrCezn8YZgA/0S7fXZcBldhYcYUQ5f0UDcUkJV4GTwO4 BtmzeXslfnzuM6bqvVbIW8Bxoz5dnFd7wbf9gRD2F6u36djhtaoxqLXpndbMPpFzgERC Qxk+1ZOuZh2OezvNIwXxVQBpSNTVPmLRbaQt8JF0bDz8fenEmeujnimocOfBnnTWGZLx U2LxCtBYEruD3OrixBrwPSWh76+6YB9fikaOChWgx44Lr1rH81P1OYfiVE5D1X3+njgr z4gMLtm8qvur/c6sHCCQL/uPLaBfnDgzWyn4TgzydyZMfmBodTS247GioVMhIohNqbzW F6Wg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=jJqwopQR7oe90OganCpQr6jTXWwwiI1n+Zx7QO87OIk=; b=i6lhtbwDVjd1kJDHy09nOcfj/Pru/9CfLeSeXshULI5mUrqSBdIMFmPH99aClSEvDF OLtqUYNFn6tgEc+A0ixd+E6CeiVJuqAuKlHTrtAScRXyJb32jHShW4pRxP3NvtCur5FZ tqmNu8scXybVy6qYKZ0AATXhjS/1KP7DZ9+CzRcLWuQWUo4dzoIeiC1UOvnz/AFFpxFI 8VLoksvXNBTATqw39gBXqNrjrAmbQe55RK2y0awzNqMc4NKnaxcnvURGm7zHNea8REgQ BCfMiM4F+NGVxRq+h8dNhEALg/W4qrUAL8P7HhbJ+tjF3oNVt4bEWPjo8gb5BPEfq9sk mfMA==
X-Gm-Message-State: ALoCoQk9mwek0Mhaps7VK3A7myOYiA14ieGWcp9ac1J+gkmHr5DRnNdoUfQRKOsXqMnuTDw7DSZQsObng0mR1/pZQFPsOz8g/0pGHO4y6e02MBQ8I6JqpojmuoIGRGGgfsYlkJAjdyzjnLNsW4/xlWgndctZp0CasxsE9ecLVWvJKOX8sN2NBRniRjf9lhF/E7jlcWiejwmp
X-Received: by 10.220.169.203 with SMTP id a11mr3200003vcz.26.1385423575965; Mon, 25 Nov 2013 15:52:55 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.100.40 with HTTP; Mon, 25 Nov 2013 15:52:35 -0800 (PST)
In-Reply-To: <CACsn0ckuupJaNKXGjP63LfZiDsV5FLOqfk902O9i1oheqtAAhA@mail.gmail.com>
References: <CAL9PXLzWPY5o2SeV=kUPWxznkw+3cmpbMpYifCebfqd48VW9UA@mail.gmail.com> <CACsn0ckuupJaNKXGjP63LfZiDsV5FLOqfk902O9i1oheqtAAhA@mail.gmail.com>
From: Adam Langley <agl@google.com>
Date: Mon, 25 Nov 2013 18:52:35 -0500
Message-ID: <CAL9PXLxueY_k0XWgTrqVxqXDgvCRhAW5UEa8YjU9_rnuZ6otTA@mail.gmail.com>
To: Watson Ladd <watsonbladd@gmail.com>
Content-Type: text/plain; charset=UTF-8
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] An SCSV to stop TLS fallback.
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 25 Nov 2013 23:52:57 -0000

On Mon, Nov 25, 2013 at 6:49 PM, Watson Ladd <watsonbladd@gmail.com> wrote:
> If firewalls block port 53, it's not the browser's problem. If
> firewalls block 80, it's not the browser's problem. Why should
> TLS 1.2 be any different?

Because firewalls that block (by RST injecting) TLS 1.2/1.1/etc
connections currently work and this change would stop them working.
Therefore it would be Chrome's fault. (This is exactly as stupid as it
sounds, yet it is the world I live in.)


Cheers

AGL