Re: [TLS] Should we require implementations to send alerts?

[Brian Smith <[e-mail]>]

Martin Thomson <[e-mail]> wrote:

> On 17 September 2015 at 14:46, Brian Smith <[e-mail]> wrote:
> > Browser vendors, if web servers were to stop sending alerts during
> handshake
> > failures, would you start doing version fallback when a connection is
> > closed?
>
> I'm not sure.  We still have a small amount of vestigal fallback code
> in our code.  We are gradually killing version fallback off and
> removing alerts would likely set that effort back.
>

Actually, Firefox has already stopped doing version fallback completely for
all versions of TLS it supports, unless the website is on a whitelist.
That's not really "gradually."

We're not sure where we stand with version fallback and 1.3.  We don't
> know how much version intolerance 1.3 will generate.  That at least
> might not depend on alerts, though we don't know just yet.
>

A conformant TLS 1.3 implementation cannot be version intolerant. If it
were version intolerant then it would not be a conformant TLS 1.3
implementation. So, conformance requirements for TLS .1.3 servers don't
matter as far as version intolerance is concerned.


> I don't see much support for the notion that forbidding alerts is a
> good idea.  We use alerts quite a bit for basic diagnosis.  Bad
> configurations are pretty commonplace, the most common being one where
> there is no common cipher suite.  Being able to isolate the error that
> is pretty useful.
>

I still think it is better to recommend to never send alerts. But, at least
there are good reasons (which I gave much earlier in the thread) for why a
server would choose not to send alerts, e.g. out of an abundance of
caution. So, "MUST send" is clearly too far.

Cheers,
Brian
-- 
https://briansmith.org/