Re: [TLS] Working Group Last Call for draft-ietf-tls-downgrade-scsv-00

[Andrey Jivsov <[e-mail]>]

(On handling of the downgrade to a recent versions of the protocols, 
i.e. TLS1.3 to 1.2 or TLS1.2 to TLS1.1.)

Today, for example,

    www.wellsfargo.com, citibank.com, and bankofamerica.com don't 
support TLS 1.1 and

    mozilla.com doesn't support TLS 1.2.

The draft -00 asks the server supporting TLS 1.2 to fail the TLS 1.1 in 
some cases, while significant amount of traffic on the Internet goes 
over TLS 1.0.

I propose the following change that allows to do exactly what rev -00 
says, but now enables more tolerant server behaviour.

The text captures the need to be more forceful on the lower (insecure) 
end of the SSL2.0 - TLS1.2 range, while being more tolerant with more 
recent (secure) versions.

 > 3. Server behaviour
 >
 > This section specifies server behaviour when receiving the
 > TLS_FALLBACK_SCSV cipher suite from a client in
 > ClientHello.cipher_suites.
 >
> When TLS_FALLBACK_SCSV appears in ClientHello.cipher_suites and the
> highest version of the protocol supported by the server is greater
> than the version indicated in ClientHello.client_version, this is an
> indication to the server that the client chose lower version of the
> protocol in its ClientHello message than the client is capable of
> negotiating.
 >
> When the server detects the above scenario, it MUST respond with an
> inappropriate_fallback alert when ClientHello.client_version
> indicates version <XXX> or lower and MAY respond with an
> inappropriate_fallback alert for higher versions of the protocol.

I would further propose to set <XXX> = SSL 3.0 and I accept to have it 
at TLS 1.0 as a second choice.

In the first case, it's easy to notice that if the server has disabled 
SSLv3 (and SSLv2) and tolerates TLS 1.0 and TLS 1.1, the server is 
compliant with the TLS_FALLBACK_SCSV.

If <XXX> = TLS 1.0, SSL3.0, SSL2.0 are disabled, the server may consider 
TLS 1.1 as acceptable (but also may choose to be intolerant of it + 
SCSV, although IMO this is undesirable today) but the server is required 
to issue inappropriate_fallback for TLS 1.0+SCSV. The server will need 
to implement parsing of SCSV in this case because it is required to 
distinguish TLS 1.0 from TLS 1.0+SCSV and have code to issue 
inappropriate_fallback.

Thank you.