Re: [TLS] One approach to rollback protection

[Martin Rex <[e-mail]>]

Eric Rescorla wrote:
> 
> I've been doing some thinking about how to prevent rollback to
> TLS 1.0/SSLv3 from TLS 1.1-capable agents.
> 
> Since there's very little deployment of TLS 1.1+, basically anything
> we do now will roll out more or less in parallel with TLS 1.1 deployment,
> as long as it's backward compatible.The obvious technique here is to
> stuff the relevant indicator in the cipher suites list, since we know that
> servers ignore unknown entries there.
> 
> I've taken an initial crack at a draft for this:
> http://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-version-cs.txt

My personal favourite would be to use an OR'ed bitmask, and we could
either "waste" a whole 256 cipher suite codepoints (or be more conservative
and require the reserved bits below to be all ZERO--requiring
only 16 cipher suite code points starting at a block boundary).

    version_major  = 0xYY (assigned/reserved by IANA as { 0xYY, * } )
    version_minor  = a set of 8 bits indicating TLS version offered by client

     x80|x40|x20|x10|x08|x04|x02|x01   Value
      7 | 6 | 5 | 4 | 3 | 2 | 1 | 0    Bit Position

      |   |   |   |   |   |   |   |
      |   |   |   |   |   |   |   | 
      |   |   |   |   |   |   |   `-  indicates SSLv3   support {0x03,0x00}
      |   |   |   |   |   |   `-----  indicates TLSv1.0 support {0x03,0x01}
      |   |   |   |   |   `---------  indicates TLSv1.1 support {0x03,0x02}
      |   |   |   |   `-------------  indicates TLSv1.2 support {0x03,0x03}
      |   |   |   `-----------------    (reserved for TLSv1.3)
      |   |   `---------------------    (reserved for TLSv1.4)
      |   `-------------------------    (reserved for TLSv1.5)
      `-----------------------------    (reserved for TLSv1.6)

    So a client offering SSLv3, TLSv1.0 an TLSv1.1
    would include cipher suite  { 0xYY, 0x07 }

    And a client offering TLSv1.0 and TLSv1.2 (but not SSLv3 and not TLSv1.1)
    would include cipher suite  { 0xYY, 0x82 }


-Martin