Will TLS_FALLBACK_SCSV on a server that only supports TLSv1 block a connection from a client using TLSv1.2

Question

I've read the draft RFC in relation to TLS_FALLBACK_SCSV and understand that if both the client and server implement this feature and a client sends this as part of clienthello, the server must reject the connection, if it's version of TLS is higher that the version of the client.

However, it's not clear to me what the correct action should be, when a clienthello contains a version of TLS higher, than that supported by the server, i.e. the client requests TLSv1.2 but the server only implements TLSv1. Should the server in this case reject the connection, or should the client and server be able to negotiate to TLSv1?

Could someone please confirm as I'm looking into an issue where the above would be the case and the remote server which only implements TLSv1 rejects the client connection.

Answer 1

The client will send TLS_FALLBACK_SCSV only if it does a TLS handshake with a downgraded version and the server will only reject a connection containing TLS_FALLBACK_SCSV if it can do a better version. Examples:

• Client can do TLS 1.0 and TLS 1.2, i.e. TLS 1.2 is the best. Server supports only TLS 1.0. Client will try with TLS 1.2 first. Usually the server replies with TLS 1.0 because that's all it supports. But some server are broken and completely fail the handshake in which case browsers do a connection downgrade. In this case the browser does a TLS 1.0 handshake but sets TLS_FALLBACK_SCSV to indicate that it does a fallback. Since the server only does TLS 1.0 anyway it will not complain but accept the connection.
• In the second example the same client is used but the server support TLS 1.2 too. A man in the middle is sitting between client and server and disrupts some connection in the hope for force a TLS downgrade. After the first TLS 1.2 connection from the client will be disrupted and fail the client will try again with TLS 1.0 but set TLS_FALLBACK_SCSV. This time the attacker will let the connection pass and the server will receive the TLS 1.0 handshake which includes TLS_FALLBACK_SCSV. Since the server can do better than TLS 1.0 it will reject the connection.