Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

[Brian Smith <[e-mail]>]

On Fri, Sep 26, 2014 at 11:58 AM, Brian Smith <[e-mail]> wrote:
> On Fri, Sep 26, 2014 at 12:34 AM, Bodo Moeller <[e-mail]> wrote:
>>> I'm OK with that, but if this is the real reason for the MUST, then
>>> it's not particularly clear.
>>
>> Hm, maybe so. I can add a brief note showing how the handshake would fail if
>> the server acts on the SCSV in this case, but I don't think the document
>> should have to explain why we require the client to omit the SCSV rather
>> than having the server ignore it. (Why would you want to send it if nothing
>> follows from that?)
>
> Here is what the draft actually says:
>
>       However, as an exception to the above, when the client intends to
>       perform an abbreviated handshake to resume a previously negotiated
>       session and sets ClientHello.client_version to the protocol
>       version negotiated for that session, the client MUST NOT include
>       TLS_FALLBACK_SCSV in ClientHello.cipher_suites.
>
> So, if the client does NOT set ClientHello.client_version to the
> version negotiated for that session, then the client MAY send the SCSV
> in the resumption handshake.

Bodo, could you please reword the above to make it clearer? e.g.:

"However, as an exception to the above, when the client sets
ClientHello.client_version to the protocol version negotiated for for
a session that it is trying to resume, and that version is less than
the ClientHello.client_version it would otherwise send if it were not
attempting to resume a session, then the client MUST NOT include
TLS_FALLBACK_SCSV in ClientHello.cipher_suites.

For example, if the client is doing a non-secure fallback, and it is
resuming a session that previously negotiated TLS 1.0, and it sets
ClientHello.client_version to TLS 1.1, then TLS_FALLBACK_SCSV must be
included in ClientHello.cipher_suites. However, as another example, if
the client is resuming a session that previously negotiated TLS 1.0,
and it sets ClientHello.client_version to TLS 1.0 to match the version
number of the session, then it must not include TLS_FALLBACK_SCSV in
ClientHello.cipher_suites."

> Now, if the server could indicate that it supports the SCSV somehow in
> its ServerHello, then the client could save that acknowledgement in

Please ignore this suggestion I had about an explicit indicator. It
isn't important and there are better ways of accomplishing the same
effect.

Cheers,
Brian