Authenticating fallback to RFC 6083 about draft-westerlund-tsvwg-dtls-over-sctp-bis

[gloinul]

First for clarity it is RFC 6083 that defines the previous version of DTLS/SCTP.

Thanks for the idea, this actually looks practically doable which is hard when you are lacking the hooks in the earlier versions. Will discuss with @emanjon about this.

[emanjon]

This seems like an excellent idea. Defining a new TLS extension seems like an easy and clean approach. A suitable solution is probably that the extention does not contain any data and that that presence of the extentions mean support of draft-ietf-tsvwg-dtls-over-sctp-bis. Reusing SCSV seems messy. Regarding DTLS versions, it might make sense to just forbid DTLS 1.2 now that DTLS 1.3 is published and supported by several libraries.

[emanjon]

@gloinul below is a explanation of how the downgrade protection in TLS 1.3 works

https://blog.gypsyengineer.com/en/security/how-does-tls-1-3-protect-against-downgrade-attacks.html

DTLS 1.3 work the same

  random:  Same as for TLS 1.3, except that the downgrade sentinels
      described in Section 4.1.3 of [TLS13] when TLS 1.2 and TLS 1.1 and
      below are negotiated apply to DTLS 1.2 and DTLS 1.0, respectively.

[emanjon]

I think the next step is to define the fallback extention. We could define that the intiator using RFC 6083 but supporting draft-ietf-tsvwg-dtls-over-sctp-bis use the extension but it is likely simpler that a initiator supporting draft-ietf-tsvwg-dtls-over-sctp-bis always use the extension. The responder abort if RFC 6083 is used, the responder supports draft-ietf-tsvwg-dtls-over-sctp-bis, and the draft-ietf-tsvwg-dtls-over-sctp-bis extension was present.

[emanjon]

Does this extention mean that the document updates RFC 6083 after all?

[emanjon]

I made a PR. This is theoretically nice, but is it worth it practically? This requires 3GPP changing the DTLS implementation. I think I will change the PR so that the extension is only send in RFC6083. My understanding is that 3GPP will just forbid fallback. It would then be bad to force more updates to DTLS libraries.