Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

[Bodo Moeller <[e-mail]>]

Nikos Mavrogiannopoulos <[e-mail]>:

> It certainly makes sense to fix those broken servers. I disagree with
> > fixing them *instead* of deploying TLS_FALLBACK_SCSV; I think that's a
> > false dichotomy. If you are willing to stop fallback retries in the
> > client products that Red Hat distributes right now, great (do you?),
> > but clearly not everyone is willing to take that step at this time.
> > Until it has happened, clients already can benefit from
> > TLS_FALLBACK_SCSV.
>


> I disagree. It is a correct dichotomy :) If the servers are fixed, there
> is no use for the fallback SCSV, as clients would not need to perform
> the insecure fallback.
>

True, but clearly they aren't fixed *now*, and more importantly, various
current clients *do* still find it necessary to use fallback retries to
work with such servers.

I agree that TLS_FALLBACK_SCSV is hypothetically pointless :-)

In reality, though, it does serve a purpose.


As of the argument that clients would be protected from the SCSV, that
> only works if both the clients _and_ the servers are updated to support
> the fallback SCSV. Why is that step necessary, if we can instead fix the
> clients and the servers to properly negotiate TLS?


Using the SCSV already helps if *some* servers have been updated to support
it: connections to these servers, at least, will be more secure. For other
servers, you get what you have now.

Disabling fallback retries provides more encompassing protection, but
before you can take that step, you *first* need to fix the servers (that
is, all servers you'd still want to be able to connect to).

If you want to protect information in practice, it's not sufficient to be
confident to have a solution at some point in the future. It also matters
when you can deploy it. There's nothing that blocks you from deploying
TLS_FALLBACK_SCSV -- the broken servers will be just as broken, but you
don't depend on them getting fixed to be able to protect your connections
to servers that do support TLS_FALLBACK_SCSV.

Bodo