Subject: Re: [TLS] backwards compatibility section updates

From: Brian Smith <[email-masked]>
Date: Sun, 28 Dec 2014 09:15:22 -0800

Dave Garrett <[email-masked]> wrote:
> Suggestions for other things that might be warranted to add:
>
> 1) Require SCSV?

No. Anything related to non-secure fallback should be put in the
separate downgrade-scsv draft, and not in the TLS specification, since
implementations shouldn't be doing the non-secure downgrade anyway.

> 2) Require/recommend Encrypt-then-MAC on fallback?

No. The TLS 1.3 spec should focus on specifying TLS 1.3, which doesn't
allow CBC-mode cipher suites. Another document can deal with
recommending Encrypt-then-MAC.

> 3) Add note about ClientHello length bug in certain implementations?
>     (what officially happened to the padding extension?)

IIUC, F5 servers that have the ClientHello length bug probably also
have the POODLE bug, so a client implementing the padding extension
may actually be a loss for security. Also, some Cisco server
implementations do not work with the padding extension. So, I don't
think it makes sense to recommend the padding extension in the spec.

Cheers,
Brian

---

From: Dave Garrett <[email-masked]>
Date: Sun, 28 Dec 2014 07:13:09 -0500

I've updated my PR for revisions to the TLS 1.3 backwards compatibility section.

https://github.com/tlswg/tls13-spec/pull/107

(SSL changes in PR 105)

1) Require SCSV?

Anything else in here that needs fixing/updating?

Note that Encrypt-then-MAC sounds good, but I don't know if enough 
implementations will support it but not TLS 1.3 to be worth mandating.

Dave