Subject: [TLS] Viability of fallback SCSV and padding drafts.

From: Adam Langley <[email-masked]>
Date: Thu, 27 Feb 2014 12:47:59 -0500

Chrome 33 went stable[1] on the 20th and contained implementations of
both the fallback SCSV[2] and padding drafts[3]. The fallback SCSV is
also enabled for Google properties.

Of the two, padding was significantly more trouble. In order to flush
out problems, Chrome 33 pads all ClientHellos to 512 bytes, whether
they would have been smaller than 256 bytes or not.

One, Windows based, "anti-virus" product broke because it made
assumptions about the maximum size of a ClientHello. One network
middleware product broke for the same reasons.

Both have now been updated. (Thankfully, the design of the network
middleware was such that it could be updated for all users.)

A second, "anti-virus" product also broke, Kaspersky, and it's unclear
which of the two changes caused the problem. Kaspersky has a history
of such issues but the TLS MITM mode is disabled by default and this
has not been a major source of user feedback.

It's possible that smaller breakages have also occurred but I've seen
no evidence of that yet. We continue to follow up on user reports in
case there's something that got missed.

We're going to change Chrome 33 to only pad ClientHellos when needed,
but that's the only change scheduled so far. Otherwise both changes
are holding steady and appear viable.

Cheers

AGL

[1] http://googlechromereleases.blogspot.com/2014/02/stable-channel-update_20.html
[2] https://tools.ietf.org/html/draft-bmoeller-tls-downgrade-scsv-01
[3] https://tools.ietf.org/html/draft-agl-tls-padding-03

---

From: Dr Stephen Henson <[email-masked]>
Date: Thu, 27 Feb 2014 18:19:49 +0000

> are holding steady and appear viable.

That's good to know. I'm hoping that once there is an official designation for
the padding extension (any news on when that might be?) it can be enabled by
default in OpenSSL, at present it needs a compilation option. It could then
appear in 1.0.2 when it is officially released and 1.0.1 releases.

Steve.
-- 
Dr Stephen N. Henson.
Core developer of the   OpenSSL project: http://www.openssl.org/
Freelance consultant see: http://www.drh-consultancy.co.uk/
Email: [email-masked], PGP key: via homepage.