Re: [TLS] The TLS_FALLBACK_SCSV time bomb (was: Re: Working Group Last Call for draft-ietf-tls-downgrade-scsv-00)

[Martin Thomson <[e-mail]>]

On 17 October 2014 06:51, Bodo Moeller <[e-mail]> wrote:
> I know. This is exactly why OpenSSL does honor SSL_MODE_SEND_FALLBACK_SCSV
> even when the highest supported protocol version is enabled. (So the best
> way to make the API less fragile might be to create an additional setting
> that makes SSL_MODE_SEND_FALLBACK_SCSV behavior unconditional, such as
> SSL_MODE_SEND_FALLBACK_SCSV_FOR_TESTING.)

I considered building this sort of feature, but it comes down to this:
if you are doing the fallback thing, such that setting this option is
even a possibility, then you are already tall enough to work out when
to send the SCSV and when not to.

Furthermore, we have situations where clients are configured to send
less than the highest version initially, such that it would not be
appropriate to set the SCSV.  And, we now have experimental TLS 1.3
code in NSS, all of which makes the question of  what the actual
highest version that is supported quite murky.

Another alternative is to have a value that is set to the highest
version permitted.  Handshakes that go out with lower version numbers
get marked with the SCSV.  Set this to a low value and the SCSV is
suppressed.