IETF Logo Mail Archive

Re: [TLS] An SCSV to stop TLS fallback.

Adam Langley <agl@google.com> Tue, 26 November 2013 17:34 UTC

Return-Path: <agl@google.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D93081AE213 for <tls@ietfa.amsl.com>; Tue, 26 Nov 2013 09:34:53 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.38
X-Spam-Level:
X-Spam-Status: No, score=-1.38 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5rX87nolut8l for <tls@ietfa.amsl.com>; Tue, 26 Nov 2013 09:34:53 -0800 (PST)
Received: from mail-ve0-x229.google.com (mail-ve0-x229.google.com [IPv6:2607:f8b0:400c:c01::229]) by ietfa.amsl.com (Postfix) with ESMTP id B8FFE1ADFAD for <tls@ietf.org>; Tue, 26 Nov 2013 09:34:52 -0800 (PST)
Received: by mail-ve0-f169.google.com with SMTP id c14so4439381vea.28 for <tls@ietf.org>; Tue, 26 Nov 2013 09:34:52 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=uQS86rBzXpsLOvl40UjQlXV2SxOCAQsqGXAS8BwR2Ro=; b=UT8jMnxMqEXuOUDHk5RLIpHW+/AHOyrO/PYyRUp6g60Im/SaV7Dixk267SrGun9cW3 Gj+49qdsfDmCWkFLLvKTIX/o9LLESLq5kuh7egDftJSga4ECVGlMuTRCIK4HDMf9hor9 v2CznR5b5vjm4SfD+OV81XX2pOoHJOlpwUqSW0t07KkGA0m3MzTaa53rkJe9XqUWniur 4trFe45X6cIIr07AMiQWkjvKlTMSVkDwgHZHu0GWO9HBQPF5GfAOLmb1iGmZafsehXoA lYy0vMhBk1qy5GkAYMY5zaDUIt0ntrXaMWcdYapaIcvK46q+xxfxGHwxuwSbWKXgKDcw lP2w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=uQS86rBzXpsLOvl40UjQlXV2SxOCAQsqGXAS8BwR2Ro=; b=ZKBaf03kl3cjgu7rmj0Qxk78DCbzjDk5S2+5QriPeyMILXTMADFi1D1ICMeZaAYByD 0kDrPgUYfU6wVGyji9MglP8CpUF1YfQ18Pf4LD3E+TdSYyHgpwLedxeAXjsY3Utex6Q1 NB7f7jkDjp0deh2scYZSKEusnTzqo7mGyKQ1ecYrLfMKHWgdscGN5gBp+14Hoy+kP79B cwvBqa2KBmFqJCsF12UWWX4zg0yKHnn5evarVfcqp4kq138DZZXt5TmFK7BIH5vKq2ZV ZK8f9WPrxWXQbpHXvmTGO3lgifgO5yB+fD/nnSk9OqfDypAuitBL1kCRfLT2tmrs+6Ck JNkA==
X-Gm-Message-State: ALoCoQl+vlt2AgpQZ6LHmFfwcD4n+7RLhdumqWR4ud3aucjWlH0B4i0L/VMFBJjuL9ZS7ySxEm78oqzSZj7IFqS2TbT9Fvykat7i1nNeMWBpI0cpB/jezAcx6gHk9Uo7sV+VD51IVpQVypqc58/86ybVDHz8z77gO4DNK77KJhrzOlNNspx8IPaU6EKIXs1Jk7S7ZObbFIGX
X-Received: by 10.52.187.138 with SMTP id fs10mr25535084vdc.10.1385487292397; Tue, 26 Nov 2013 09:34:52 -0800 (PST)
MIME-Version: 1.0
Received: by 10.52.100.40 with HTTP; Tue, 26 Nov 2013 09:34:32 -0800 (PST)
In-Reply-To: <20131126021923.E56981AAF0@ld9781.wdf.sap.corp>
References: <CAL9PXLzWPY5o2SeV=kUPWxznkw+3cmpbMpYifCebfqd48VW9UA@mail.gmail.com> <20131126021923.E56981AAF0@ld9781.wdf.sap.corp>
From: Adam Langley <agl@google.com>
Date: Tue, 26 Nov 2013 12:34:32 -0500
Message-ID: <CAL9PXLyqDbOy7vEwNyJD=jwB_UD+QPn6q8a-WCfni3BwxHZT9w@mail.gmail.com>
To: mrex@sap.com
Content-Type: text/plain; charset="UTF-8"
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] An SCSV to stop TLS fallback.
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 26 Nov 2013 17:34:54 -0000

On Mon, Nov 25, 2013 at 9:19 PM, Martin Rex <mrex@sap.com> wrote:
> If there is a problem in negotiating what _we_want_to_do_, because the
> installed base does not like the kind of negotiation that was originally
> proposed to be used, then the pragmatic engineering approach will be
> to define an alternative negotiation of at least a useful subset
> that will be compatible with the installed base, and which will not need
> to be stripped from a "conservative fallback handshake" -- and therefore
> will be resilient to downgrade attacks, and cope with retarded middle boxes.

Backporting AES-GCM, ECDHE, etc all the way back to SSLv3 is a
possibility if it comes to it. However, it's a lot more work than the
anti-fallback mechanisms currently under consideration so I'd want to
exclude them first.

I know know of a reason to believe that they would have less
compatibility problems than an SCSV.


Cheers

AGL

v2.23.0 | Report a Bug | By Email