[TLS] Comments on draft-rescorla-tls-renegotiation-01.txt

[Kyle Hamilton <[e-mail]>]

I hadn't actually read this before I wrote my last message.  It
includes both of the aspects that I stated were necessary (a TLS
extension and a magic cipher identifier), and I support it.

4.3.1:
Clients which choose to fall back to an extensionless mode of
   operation MUST include the magic cipher suite [TBD] in any such
   handshake.  Servers MUST reject any ClientHello which uses this
   cipher suite but does not include RI with a fatal "handshake_failure"
   alert.  Because servers ordinarily ignore unknown cipher suites, this
   cipher suite can be added safely on any handshake, thus allowing
   detection and prevention of the MITM attack described above.

This is absolutely essential.  TLS extensions exist, but SSL 3 is
still commonly used.  There's no reason why SSL 3 shouldn't benefit
from anything that happens after-the-fact, even though it was never an
actual IETF protocol.

The only issue I see is... we've got an issue in signalling back to
the client that it knows how to do the updated handshake.  Would a
slightly modified HelloRequest do it?

-Kyle H