Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

[[e-mail] (Martin Rex)]

Martin Thomson wrote:
> 
> The draft requires that downgrade on resumption attempts (yes, you are
> completely correct) is not guarded.

Today's servers are permitted to completely ignore resumption requests
(and perform a full handshake instead) for protocol versions other than
the version that was used to create the (cached) session.  

Allowing resumption of cached sessions with different parameters
(such as a different protocol version or different cipher suite)
would look more like a server bug to me.

Or could this actually be abused as a "feature":
1. create a new TLS session with TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384
   with a Windows 2008R2 Server (IIS).

2. propose resumption with the previously created session, but
   try to make server resume with TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256

for processing resumption, the key exchange portion of the cipher suite
would technically not strictly be necessary.  But the server may have
groomed his list of supported cipher suites (not having an ECDSA cert)...


-Martin