Re: [TLS] SCSV versioning

[Geoffrey Keating <[e-mail]>]

Bodo Moeller <[e-mail]> writes:

> > The implicit assumption made by the SCSV is that all new servers
> > (supporting the SCSV) will not have bugs requiring a fallback.  As
> > soon as that first server appears which supports SCSV but requires
> > fallback, this SCSV can't be used.
> 
> 
> This would affect fallback handshakes from *future* protocol versions to
> TLS 1.2, as we've seen that it's not a problem in practice when falling
> back from TLS 1.2 to earlier versions. So it could mean that clients that
> want to maintain interoperability with servers that can't handle their TLS
> 1.3 handshake attempts might not want to send TLS_FALLBACK_SCSV in fallback
> handshake Client Hello messages announcing TLS 1.2. (The document's
> Security Considerations cover this, by the way.) I don't see how it could
> be a reason to not use the SCSV when falling back to a version below TLS
> 1.2.

It affects any client which is talking to a server which is buggy and
where the bugs can be avoided by a fallback.  For example, a server
with an issue in its TLS 1.2 implementation (perhaps in an extension),
which could be solved by retry and fallback with TLS 1.1 or without
the extension, would instead be prevented from working by the SCSV.

As far as I know, there are no currently known examples of such
servers, but it doesn't seem unreasonable that such a thing might
appear in the future.