Re: [TLS] assert TLSext in renego-ServerHello instead of disable renego

[Eric Rescorla <[e-mail]>]

At Thu, 12 Nov 2009 09:33:12 -0800,
Michael D'Errico wrote:
> 
> Eric Rescorla wrote:
> > At Tue, 10 Nov 2009 09:08:20 -0800,
> > Michael D'Errico wrote:
> >> A client that wants protection from this attack MUST send the extension
> >> in its initial handshake.  Why don't you want to do that?
> >>
> >> The attack being discussed happens on the client's *initial* handshake.
> >> The server sees it as a renegotiation, so the client needs to be able to
> >> tell the server that it thinks it is performing an initial handshake.
> >> That is exactly what this extension provides.  If you don't send the
> >> extension on an initial handshake you are risking being attacked.
> > 
> > I don't see that that's the case: you're risking being attacked in
> > any case if the server is not upgraded.
> 
> My point was that if the server *is* upgraded and the client does not
> send the extension on its initial handshake, it is taking an unnecessary
> risk.

The issue isn't whether the client sends it. Of course the client
sends it. It's whether the client aborts the connection of the server
doesn't return it.

-Ekr