Re: [TLS] SCSV vs RI when both specified. Was: Updated draft

[Marsh Ray <[e-mail]>]

Martin Rex wrote:
> 
> There is a document, approved by the IESG, where both of you are
> listed as document co-authors, and it says this:
> 
> http://tools.ietf.org/html/draft-ietf-tls-renegotiation-03#section-4.3
> 
> 
> 4.3. Server Considerations
> 
> If the client does not offer the "renegotiation_info" extension or 
> the TLS_RENEGO_PROTECTION_REQUEST SCSV then this indicates that the 
> client does not support secure renegotiation.  However, because the 
> above attack looks like two handshakes to the server, the server can 
> safely continue the connection as long as it does not allow the 
> client to renegotiate.
> 
> I'm fine with that "the server can safely continue the connection as
> long as it does not allow the client to renegotiate."

I'm not, and I argued against the inclusion of that language repeatedly.

The explanation I was given, IIRC, was that it was just referring to
"the above attack" which was the one simplest case to explain. It was
not supposed to be exhaustive of all attacks.

I firmly believe that the language "the server can safely continue the
connection as long as it does not allow the client to renegotiate" is in
error.

It was not worth continuing to argue about if it delays the
implementation of the fix (which is the same in any case).

> I don't want to continue discussing this issue.

Agreed.

I'll just have to make my point with working exploit code.

- Marsh