Subject: Re: [TLS] Comments/Questions on draft-gutmann-tls-encrypt-then-mac-00.txt

From: Peter Gutmann <[email-masked]>
Date: Thu, 26 Sep 2013 04:27:15 +0000

Michael D'Errico <[email-masked]> writes:

>Instead of particular versions, it seems to me that an indicator of "I
>tried to connect using a higher version than I'm using now but had to
>fall back to this verion" would cover any case now or later.

That seems more intuitively useful from the server admin's point of view,
you could use it to gather traffic stats on forced fallbacks, detect
middleboxes, and so on.  It'd also allow you to make informed decisions
on how far you want to fall back, for example you could use it to 
determine that only 0.5% of users are having to fall back to SSLv3 and 
therefore refuse to connect below TLS 1.0.

Peter.

---

From: Yoav Nir <[email-masked]>
Date: Fri, 27 Sep 2013 13:43:49 +0000

> therefore refuse to connect below TLS 1.0.

That kind of statistics collection would work if clients did something like this:
 - Try with TLS 1.2 with extensions... failed
 - Try with TLS 1.1 with extensions... failed
 - Try with TLS 1.0 with extensions... failed
 - Try with TLS 1.0 without extensions... failed
 - Try with SSLv3

But browser makers are very much concerned about connection time. So the sequence is going to be TLS 1.0 (with 1.2 in the ClientHello) with extensions, and then straight down to SSLv3 (or TLS 1.0 without extensions if SSLv3 is disabled).

So if something blocks TLS 1.1 or 1.2, you're going to get the percentage of clients that have SSLv3 enabled (and are behind some meddling middlebox)

Yoav