Re: [TLS] SCSVs and SSLv3 fallback

[[e-mail] (Martin Rex)]

Yngve N. Pettersen wrote:
> >>
> >> I hope my proposal might manage that, but I don't think EKR and Adam's
> >> proposals will, since they try to work around the broken servers and
> >> middleboxes, and do not confront them.
> >
> > Not sure that's true.  From Eric's draft [3]:
> > """
> > If the SCSV value is present and is not equal to
> > ClientHello.client_version, then the server MUST terminate the
> > handshake with a fatal "handshake_failure" alert.
> > """
> >
> > From Adam's post [4]:
> > """
> > the semantics of TLS_CAPABLE_SCSV would be that servers would reject
> > any SSLv3 handshakes that included this ciphersuite with a fatal
> > error.
> > """

What I extremely dislike about both of these ideas is

(a) they both try to actively increase the interop failures,
    rather than decrease it

(b) they both ignore the various kinds of breakage out there
    in the installed base that may require ClientHello.client_version
    to have a specific value to make broken servers happy, rather than
    the value actually desired by the client.

(c) Keep in mind that there is not just old breakage out there,
    e.g. Microsoft shipped new breakage with Win7/Win2008R2 where
    they goofed the RSA premaster protocol version check on the
    renegotiation handshake.

For any kind of alternative TLS version negotiation, the server ought to
entirely ignore the existing ClientHello.client_version, and use the
new version signaling alone for determining the highest common protocol
version.


-Martin