Re: [TLS] checking on an scsv point

[[e-mail] (Martin Rex)]

Martin Thomson wrote:
[ Charset UTF-8 unsupported, converting... ]
> On 18 February 2015 at 11:28, Martin Rex <[e-mail]> wrote:
> > You mean that this client will fallback further _down_, rather than
> > upwards as the server suggests?
> 
> Indeed.  I expect that to be a common response.
> 
> > I assume this is mostly because the App does the heuristics here
> > and has little information to do its heuristics (it probably doesn't
> > have the ServerHello to look at).  But that should be an easy
> > fix to the app heuristics.
> 
> I'm largely talking about apps that don't change here, because if they
> were to change, then I'd be arguing for disabling fallback.  It's
> actually fairly easy to make the change, because the app is usually
> well aware of the fact that it is performing a fallback when it does.
> What is needed is a signal to the TLS stack that it should accept a
> higher version in the ServerHello.

But isn't that signal _already_ there: the request for the FALLBACK_SCSV.
How does the App signal that the FALLBACK_SCSV should be included?

-Martin