Re: [TLS] An SCSV to stop TLS fallback.

Adam Langley <> Tue, 26 November 2013 17:34 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id D93081AE213 for <>; Tue, 26 Nov 2013 09:34:53 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.38
X-Spam-Status: No, score=-1.38 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 5rX87nolut8l for <>; Tue, 26 Nov 2013 09:34:53 -0800 (PST)
Received: from ( [IPv6:2607:f8b0:400c:c01::229]) by (Postfix) with ESMTP id B8FFE1ADFAD for <>; Tue, 26 Nov 2013 09:34:52 -0800 (PST)
Received: by with SMTP id c14so4439381vea.28 for <>; Tue, 26 Nov 2013 09:34:52 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=uQS86rBzXpsLOvl40UjQlXV2SxOCAQsqGXAS8BwR2Ro=; b=UT8jMnxMqEXuOUDHk5RLIpHW+/AHOyrO/PYyRUp6g60Im/SaV7Dixk267SrGun9cW3 Gj+49qdsfDmCWkFLLvKTIX/o9LLESLq5kuh7egDftJSga4ECVGlMuTRCIK4HDMf9hor9 v2CznR5b5vjm4SfD+OV81XX2pOoHJOlpwUqSW0t07KkGA0m3MzTaa53rkJe9XqUWniur 4trFe45X6cIIr07AMiQWkjvKlTMSVkDwgHZHu0GWO9HBQPF5GfAOLmb1iGmZafsehXoA lYy0vMhBk1qy5GkAYMY5zaDUIt0ntrXaMWcdYapaIcvK46q+xxfxGHwxuwSbWKXgKDcw lP2w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=uQS86rBzXpsLOvl40UjQlXV2SxOCAQsqGXAS8BwR2Ro=; b=ZKBaf03kl3cjgu7rmj0Qxk78DCbzjDk5S2+5QriPeyMILXTMADFi1D1ICMeZaAYByD 0kDrPgUYfU6wVGyji9MglP8CpUF1YfQ18Pf4LD3E+TdSYyHgpwLedxeAXjsY3Utex6Q1 NB7f7jkDjp0deh2scYZSKEusnTzqo7mGyKQ1ecYrLfMKHWgdscGN5gBp+14Hoy+kP79B cwvBqa2KBmFqJCsF12UWWX4zg0yKHnn5evarVfcqp4kq138DZZXt5TmFK7BIH5vKq2ZV ZK8f9WPrxWXQbpHXvmTGO3lgifgO5yB+fD/nnSk9OqfDypAuitBL1kCRfLT2tmrs+6Ck JNkA==
X-Gm-Message-State: ALoCoQl+vlt2AgpQZ6LHmFfwcD4n+7RLhdumqWR4ud3aucjWlH0B4i0L/VMFBJjuL9ZS7ySxEm78oqzSZj7IFqS2TbT9Fvykat7i1nNeMWBpI0cpB/jezAcx6gHk9Uo7sV+VD51IVpQVypqc58/86ybVDHz8z77gO4DNK77KJhrzOlNNspx8IPaU6EKIXs1Jk7S7ZObbFIGX
X-Received: by with SMTP id fs10mr25535084vdc.10.1385487292397; Tue, 26 Nov 2013 09:34:52 -0800 (PST)
MIME-Version: 1.0
Received: by with HTTP; Tue, 26 Nov 2013 09:34:32 -0800 (PST)
In-Reply-To: <>
References: <> <>
From: Adam Langley <>
Date: Tue, 26 Nov 2013 12:34:32 -0500
Message-ID: <>
Content-Type: text/plain; charset=UTF-8
Cc: "" <>
Subject: Re: [TLS] An SCSV to stop TLS fallback.
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 26 Nov 2013 17:34:54 -0000

On Mon, Nov 25, 2013 at 9:19 PM, Martin Rex <> wrote:
> If there is a problem in negotiating what _we_want_to_do_, because the
> installed base does not like the kind of negotiation that was originally
> proposed to be used, then the pragmatic engineering approach will be
> to define an alternative negotiation of at least a useful subset
> that will be compatible with the installed base, and which will not need
> to be stripped from a "conservative fallback handshake" -- and therefore
> will be resilient to downgrade attacks, and cope with retarded middle boxes.

Backporting AES-GCM, ECDHE, etc all the way back to SSLv3 is a
possibility if it comes to it. However, it's a lot more work than the
anti-fallback mechanisms currently under consideration so I'd want to
exclude them first.

I know know of a reason to believe that they would have less
compatibility problems than an SCSV.