[TLS] The TLS_FALLBACK_SCSV time bomb (was: Re: Working Group Last Call for draft-ietf-tls-downgrade-scsv-00)

[Florian Weimer <[e-mail]>]

On 10/16/2014 03:44 PM, Salz, Rich wrote:
>> A widely-deployed client might use TLS 1.2 with FALLBACK_SCSV
>> unconditionally.
>
> A widely deployed client might also start injecting line noise into the TLS stream.
>
> We can't control what buggy clients do.  That's not new.

You recently wrote about SSL_MODE_SEND_FALLBACK_SCSV, without any 
qualifications:

“I recommend that you always set that flag.”

<http://article.gmane.org/gmane.comp.encryption.openssl.user/52991>

Unfortunately, you are not the only one who makes this mistake.

I'm now convinced that the scenario I described is extremely likely. 
The problem, of course, is that you will not notice this bug in the 
client application until the server supports TLS 1.3, when it may be too 
late to fix it in the client.

It would be better to say that connections with TLS_FALLBACK_SCSV need 
to fail unconditionally in the server, independent of client and server 
protocol version.  This approach would essentially be a promise of the 
server to be version-tolerant (or a statement of having been updated 
recently, which hopefully amounts to the same thing).  The advantage 
that it doesn't come with the time bomb that has been built into the 
current draft.

-- 
Florian Weimer / Red Hat Product Security