Re: [TLS] SCSV versioning

[Bodo Moeller <[e-mail]>]

>
> It affects any client which is talking to a server which is buggy and
> where the bugs can be avoided by a fallback.  For example, a server
> with an issue in its TLS 1.2 implementation (perhaps in an extension),
> which could be solved by retry and fallback with TLS 1.1 or without
> the extension, would instead be prevented from working by the SCSV.
>

Certainly.  However, now that a fair number of clients do support
TLS_FALLBACK_SCSV and use it in fallback retries (or may not fall back at
all), you should generally notice this kind of problem early as you try to
deploy the new server: this server just would be obviously broken and so
most likely won't make it far in its deployement.  So I think this is
extremely unlikely to become a concern in practice.

If you really were to try and do everything to interoperate with any kind
of theoretical server brokenness in your client, though, you'd end up with
lots and lots of retries -- you couldn't even rely on cipher suite
negotiation because the server might be getting individual cipher suites
wrong, for example.

The current reality of downgraded retries obviously isn't quite as
complicated, but is more complicated than just protocol versions.
TLS_FALLBACK_SCSV can take care of just one dimension, the protocol
version, because it's meant to be very simple (yet meaningful for security)
and because it would not make sense to perpetuate a snapshot of current
implementation brokenness in a protocol change.

Bodo