Re: [TLS] Non-extension solutions (requirements)

[Bodo Moeller <[e-mail]>]

On Nov 15, 2009, at 1:06 PM, Nelson B Bolyard wrote:
> On 2009-11-15 03:18 PDT, Eric Rescorla wrote:

>>   Thus, the minimal change is not to change initial negotiations at
>>   all but simply to change renegotiations. This is quite possible
>>   with RI simply by not sending it on the initial negotiation. Of
>>   course, sending it on renegotiation will cause interoperation
>>   failure with vulnerable servers, but that's the desired outcome.

> Are there clients who really want to remain vulnerable?

Um, strawman?

The minimal change is helpful for clients that want to remain  
interoperable with servers that haven't been updated yet, because

- some servers wouldn't really have to be updated because they don't  
support renegotiation in the first place;

- atomically updating all clients and servers isn't possible;

- the attack is irrelevant for opportunistic-encryption scenarios --

if these clients *accept*, as trade-off, that they'd also continue to  
be able to engage in insecure connections (when connecting to insecure  
servers).  This doesn't mean that they *want* to be vulnerable.  It  
doesn't even imply that they necessarily *are* vulnerable (this  
depends on what the higher protocol layers are actually doing with the  
TLS connections, and what servers they open connections to).

Bodo