IETF Logo Mail Archive

Re: [TLS] Downgrade SCSV info

Bodo Moeller <bmoeller@acm.org> Tue, 11 November 2014 23:33 UTC

Return-Path: <bmoeller@acm.org>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 837591A702A for <tls@ietfa.amsl.com>; Tue, 11 Nov 2014 15:33:49 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.262
X-Spam-Level:
X-Spam-Status: No, score=-0.262 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HELO_EQ_DE=0.35, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_SOFTFAIL=0.665] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Aq3yIvO-k4z9 for <tls@ietfa.amsl.com>; Tue, 11 Nov 2014 15:33:48 -0800 (PST)
Received: from mout.kundenserver.de (mout.kundenserver.de [212.227.126.187]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 240571A7000 for <tls@ietf.org>; Tue, 11 Nov 2014 15:33:48 -0800 (PST)
Received: from mail-ob0-f182.google.com (mail-ob0-f182.google.com [209.85.214.182]) by mrelayeu.kundenserver.de (node=mreue004) with ESMTP (Nemesis) id 0MWORa-1XU4El3kSI-00XZuN; Wed, 12 Nov 2014 00:33:46 +0100
Received: by mail-ob0-f182.google.com with SMTP id nt9so8996905obb.13 for <tls@ietf.org>; Tue, 11 Nov 2014 15:33:44 -0800 (PST)
MIME-Version: 1.0
X-Received: by 10.182.79.10 with SMTP id f10mr35572746obx.4.1415748824863; Tue, 11 Nov 2014 15:33:44 -0800 (PST)
Received: by 10.60.32.42 with HTTP; Tue, 11 Nov 2014 15:33:44 -0800 (PST)
In-Reply-To: <CABkgnnWbX01G0ft9uJ-=q7zFjVq0HGCqA543EK4K_f6DjHQi5g@mail.gmail.com>
References: <CABkgnnU=NM0pK1O7KdEa9T4nEo8qE3D2K4JPKSt8ShWU72DrVw@mail.gmail.com> <CADMpkcKiCAzdOpTuMvW8EXh=7-bS5KrXigZ4Vq_CFJNQGKDekg@mail.gmail.com> <CABkgnnWbX01G0ft9uJ-=q7zFjVq0HGCqA543EK4K_f6DjHQi5g@mail.gmail.com>
Date: Wed, 12 Nov 2014 00:33:44 +0100
Message-ID: <CADMpkcKFpgqNtYCto35qqriwbayf-p6j0yV29urkJ3_pHbJhzA@mail.gmail.com>
From: Bodo Moeller <bmoeller@acm.org>
To: "tls@ietf.org" <tls@ietf.org>
Content-Type: multipart/alternative; boundary="047d7b2e4014cc1e7205079db529"
X-Provags-ID: V02:K0:z9b2KpvIgrLIdX1FQJPK3YN+0W7hV83/3viP/gyI5KU AU/DG/LBYdzqPZHwOmHQuiaO7wLvbVTb4++8HJOCdoJe3KcHak M+Al4LTjJN3gsdYUQc2HWGt8GqLnQbSbdfXMDbUzMXDiyIFmMR KABlsFvGN7it1MkTsWayEyP58ULjA9awnDOG/reLQmkjNB3AFD 8EzuhVQkG7xdBE/Um/0laVwNSwT7ce8uC5JCQMBuRtMSZc+4lf abd8JIgGwNNOaJvgPvQhXQyzjG8XzHTONEtLYCiHI0C7Y47Joc FpvqJa5SXeX2jGElYEhGlYn5iuqNKjSYcOpsS/SZkcIgxiF0Yb hbIy3Y+JZoNFm/9+i0Vl6w3W0eRoe/6EyC2gxtZhOSQeuVGNDG 0vmTbSTmwEMi8A3BkwS872NiP+1JY8b740Onht82pdfLcUXWpT qit3+
X-UI-Out-Filterresults: notjunk:1;
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/x2D8UJ7f0P0tXNAxsf_LqtlwLE4
Subject: Re: [TLS] Downgrade SCSV info
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 11 Nov 2014 23:33:49 -0000

Martin Thomson <martin.thomson@gmail.com>:

> [...](Then in the end you have
>
> essentially the same outcome as if trying the protocols in decreasing
> order,
> > in the presence of an active attacker forcing you to downgrade.)'
>


> The 1.1 handshake would need the SCSV.
>

Certainly. Attempting the protocol versions in a different order doesn't
change which of them should have TLS_FALLBACK_SCSV.

v2.23.0 | Report a Bug | By Email