Re: [TLS] I-D Action: draft-ietf-tls-downgrade-scsv-03.txt

[[e-mail] (Martin Rex)]

[e-mail] wrote:
> 
> There's also a htmlized version available at:
> http://tools.ietf.org/html/draft-ietf-tls-downgrade-scsv-03
 

The current document seems still silent on the *KNOWN* problem when
a client App has been skipping TLS versions on downgrade dance.


Andrei had written about the problem here:
   http://www.ietf.org/mail-archive/web/tls/current/msg13725.html

but his suggestion: client app must NOT use FALLBACK SCSV when
skipping versions does not look like a viable solution (it removes
all protection).


MSIE 8 seems to be a browser that skips versions on downgrade dance.
MSIE 8 on Win7 with TLSv1.2 enabled, dances like this:

   TLSv1.2 (+Ext) -> TLSv1.0 (+Ext) -> SSLv3 (no Ext)


The scenario where this problem can hit is with non-malicious
middleboxes that do not recognize (and therefore do not permit)
TLSv1.2 handshakes.  I had described such a potential scenario
at the end of this message:

   http://www.ietf.org/mail-archive/web/tls/current/msg14618.html
 

And the problem can easily reappear with TLSv1.3.  I would not be surprised
to see TLSv1.2 servers implementing this abort TLS handshakes when they
receive a ClientHello with client_version={3,1} that contains the
TLS_FALLBACK_SCSV



-Martin