Subject: Re: [TLS] Last Call: <draft-ietf-tls-downgrade-scsv-03.txt> (TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks) to Proposed Standard

From: Xiaoyin Liu <[email-masked]>
Date: Wed, 21 Jan 2015 11:42:43 -0500

My argument is that suppose 50% websites support fallback SCSV now, 48% websites do not support SCSV but are version tolerant, and less than 2% are version intolerant. Is it worth to sacrifice the security of the 48%, to make the 2% "just work"?

I also want to point out that disabling RC4 and deprecating SHA-1 certificates will break some sites as well. Why could browsers afford that, but insist on doing downgrade dance?
________________________________
From: Bodo Moeller<mailto:[email-masked]>
Sent: ‎1/‎21/‎2015 10:11
To: [email-masked]<mailto:[email-masked]>
Cc: Xiaoyin Liu<mailto:[email-masked]>; Yoav Nir<mailto:[email-masked]>
Subject: Re: [TLS] Last Call: <draft-ietf-tls-downgrade-scsv-03.txt> (TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks) to Proposed Standard

Yoav Nir <[email-masked]>:

Also I want to point out that if even as few as 1.6% sites won't upgrade
> their servers, can we count on most of the rest 98% supporting SCSV?
>
>
> This is a strong argument, especially if we could obtain a list of
> high-value sites in the sense that the data on them is high-value. Sites
> like Facebook, banking, shops, email providers, dating sites, and check
> those.
>

I must admit I don't quite understand what the argument here is (sorry),
but in any case let me point out this:

If even just a *single* high-value site that you, personally, use does
support the SCSV, you'll benefit from the SCSV (provided that you're using
a browser that does a downgrade dance for compatibility with other servers
and sends the SCSV in downgraded Client Hello messages).

Bodo

---

From: Bodo Moeller <[email-masked]>
Date: Wed, 21 Jan 2015 18:09:01 +0100

Xiaoyin Liu <[email-masked]>:

>> a browser that

> My argument is that suppose 50% websites support fallback SCSV now, 48%
> websites do not support SCSV but are version tolerant, and less than 2% are
> version intolerant. Is it worth to sacrifice the security of the 48%, to
> make the 2% "just work"?

I see, thank you.

draft-ietf-tls-downgrade-scsv-03 doesn't ask that clients do downgrades at
all, it just helps them avoid security pitfalls *if* they choose to.
Historically, many browsers have done this (and still do) and while I'll be
glad if this practice can be stopped, it is still an issue for now (and if
we manage to get rid of it, it might become an issue again).  A couple of
years ago I thought it would go away, but that hasn't happened yet, and
I've seen browsers that initially tried to get along without implementing
the downgrade dance add it.  Even in the yet-to-be-released Firefox version
that disables the downgrade dance by default, there'll still be a
configurable setting for those who think they'll need it -- and the SCSV
will improve their security.

I also want to point out that disabling RC4 and deprecating SHA-1
> certificates will break some sites as well. Why could browsers afford that,
> but insist on doing downgrade dance?

I hope they'll do *all* of this. The point is that the SCSV improves your
security before you have completed such a transition -- or indeed before
you even know about a concrete vulnerability that might convince you to
disable a legacy protocol.

Bodo