Subject: [TLS] Downgrade SCSV info

From: Martin Thomson <[email-masked]>
Date: Tue, 11 Nov 2014 13:26:35 -0800

I realize that this new information is late, but this is my
understanding of how Internet Explorer implements version fallback.
Rob, please correct me if I'm wrong.

TLS 1.2 (no RC4)
TLS 1.0 (no RC4)
TLS 1.0 (with RC4)

It is my opinion that this is not that large a risk.  We are highly
likely - in my opinion, and based on the numbers we have - to have few
TLS 1.1 servers that are both intolerant to the TLS 1.2 handshake AND
implement the downgrade SCSV.

---

From: Bodo Moeller <[email-masked]>
Date: Tue, 11 Nov 2014 23:10:21 +0100

> Rob, please correct me if I'm wrong.

TLS 1.0 with TLS_FALLBACK_SCSV?

> implement the downgrade SCSV.

Right, although it couldn't hurt for the client to try TLS 1.1 next in case
it sees an inappropriate_fallback alert. (Then in the end you have
essentially the same outcome as if trying the protocols in decreasing
order, in the presence of an active attacker forcing you to downgrade.)

Bodo

---

From: Martin Thomson <[email-masked]>
Date: Tue, 11 Nov 2014 15:28:27 -0800

> TLS 1.0 with TLS_FALLBACK_SCSV?

I don't believe so.

> essentially the same outcome as if trying the protocols in decreasing order,
> in the presence of an active attacker forcing you to downgrade.)

The 1.1 handshake would need the SCSV.

---

From: Bodo Moeller <[email-masked]>
Date: Wed, 12 Nov 2014 00:33:44 +0100

Martin Thomson <[email-masked]>:

> [...](Then in the end you have
>
> order,
> > in the presence of an active attacker forcing you to downgrade.)'
>

> The 1.1 handshake would need the SCSV.

Certainly. Attempting the protocol versions in a different order doesn't
change which of them should have TLS_FALLBACK_SCSV.