Subject: Re: [TLS] Downgrade prevention with authenticated list of ciphersuites?

From: Adam Langley <[email-masked]>
Date: Wed, 2 Oct 2013 15:22:40 -0400

On Wed, Oct 2, 2013 at 3:02 PM, Seth David Schoen <[email-masked]> wrote:
> I'm wondering if there's any existing proposal for a mechanism to prevent
> ciphersuite downgrade attacks by authenticating the list of ciphersuites
> offered by a TLS server.  One way to do this might be to put the list
> somewhere in the server's certificate (maybe someone's already specified
> a way to do so?), like a "subject offered ciphersuites list".

TLS already authenticates the ciphersuite lists of both sides in the
final Finished messages.

Are you worried about misconfigured servers, or False Start, or
version fallback causing certain cipher suites to disappear?

Cheers

AGL

---

From: Seth David Schoen <[email-masked]>
Date: Wed, 2 Oct 2013 14:23:03 -0700

> version fallback causing certain cipher suites to disappear?

Nope, I just got confused about the nature of the version downgrade and
thought there was _also_ an effectively-unauthenticated transmission
of the ciphersuite list.  I agree that the Finished message makes my
suggestion superfluous!

-- 
Seth Schoen  <[email-masked]>
Senior Staff Technologist                       https://www.eff.org/
Electronic Frontier Foundation                  https://www.eff.org/join
815 Eddy Street, San Francisco, CA  94109       +1 415 436 9333 x107