Re: [TLS] DTLS Handshake race condition (Martin Rex) Tue, 13 August 2013 21:42 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 7278521F92C2 for <>; Tue, 13 Aug 2013 14:42:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -10.249
X-Spam-Status: No, score=-10.249 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_DE=0.35, RCVD_IN_DNSWL_HI=-8]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id avfknSHhMm5A for <>; Tue, 13 Aug 2013 14:42:03 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 1C0F821F9344 for <>; Tue, 13 Aug 2013 14:42:02 -0700 (PDT)
Received: from by (26) with ESMTP id r7DLg0s5016944 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 13 Aug 2013 23:42:00 +0200 (MEST)
In-Reply-To: <>
To: Michael Tuexen <>
Date: Tue, 13 Aug 2013 23:42:00 +0200 (CEST)
X-Mailer: ELM [version 2.4ME+ PL125 (25)]
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="US-ASCII"
Message-Id: <>
From: (Martin Rex)
X-SAP: out
Subject: Re: [TLS] DTLS Handshake race condition
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 13 Aug 2013 21:42:08 -0000

Michael Tuexen wrote:
> Martin Rex <> wrote:
>> The original TLS handshake is only half duplex.  Properly dealing
>> with renegotiation is therefore non-trivial.  The original TLS spec
>> addresses the overlapping of the renegotiation handshake by
>>  - omitting HelloRequests from the Handshake message hash computation.
> So this applies also to DTLS.
>>  - require the TLS client to ignore any HelloRequests that
>>    are be received during the handshake (which includes the one
>>    received after the client has already requested a new handshake
>>    by sending a ClientHello from your scenario.
> In my scenario the client never receives it, since it is
> * dropped by the network
> * but sort of ACKed by the client by sending the ClientHello and
>   therefore it is never retransmitted.
> So currently, the DTLS connection is stalled until it is taken
> down due to the retransmission timer firing too often...

If HelloRequest changes the DTLS MsgSeqNo, then simply "ignoring it"
seems no longer an option (that it was in TLS).

Ignoring it was really supposed to mean "will not affect state".
MsgSeqNo. looks like state that is relevant to the DTLS handshake
state machine.

In case the server _did_ send a HelloRequest, would glueing/prefixing another
HelloRequest to the front of the HelloVerifyRequest help?