Re: [TLS] POODLE applicability to TLS 1.0+ (was Re: Working Group Last Call for draft-ietf-tls-downgrade-scsv-00)

[Brian Smith <[e-mail]>]

On Mon, Oct 20, 2014 at 10:32 PM, Bodo Moeller <[e-mail]> wrote:

> Brian Smith <[e-mail]>:
>
> 2. The downgrade-scsv draft should be changed to say that implementations
>> MUST always send the TLS_FALLBACK_SCSV when ClientHello.client_version
>> indicates TLS 1.1 or lower if the client supports TLS 1.2.
>>
>
> Maybe, but note that this doesn't actually help against the concrete
> problem with old buggy NSS servers (because these don't handle
> TLS_FALLBACK_SCSV).
>

First of all, even that old version of NSS is not buggy, according to the
spec. My main concern isn't with old versions of NSS. My main concern is
that we do not know how many TLS 1.0 servers actually check the padding,
but we've assumed that all of them do, even though TLS 1.0 does not require
checking the padding.

Note that a 100% conformant TLS 1.0 implementation could add
TLS_FALLBACK_SCSV support exactly as spec'd and still be vulnerable to
POODLE if it doesn't check the padding in CBC-mode records. Again, I think
this is something worth adding to the security considerations of the
TLS_FALLBACK_SCSV draft.

For strong protection against bugs in old protocol versions, the only
> option is to disallow those versions completely.
>

Yes, but TLS 1.0 implementations can mitigate the risk, as most do, by
checking the padding conforms to the TLS 1.0 requirements.

And, so can SSL 3.0 implementations, right? Checking that SSL 3.0 CBC-mode
records conform to the TLS 1.0 padding rules is likely to cause some
interop problems, but those interop problems would be much less severe than
disabling SSL 3.0 completely, right? I checked and most implementations of
SSL 3.0 are following the TLS 1.0 padding rules in records that they send,
including IE6 on XP, AFAICT. It seems to me that that is a better solution
for websites that refuse to disable SSL 3.0 because they feel they need IE6
support, compared to switching to RC4-only for SSL 3.0. What do you think?

Cheers,
Brian