Re: [TLS] draft-ietf-tls-renegotiation-01.txt and DTLS

[Michael Tüxen <[e-mail]>]

On Nov 30, 2009, at 7:06 PM, Marsh Ray wrote:

> Michael Tüxen wrote:
>> 
>> If I'm not wrong, then the attack which works against TLS does not
>> work against DTLS, since DTLS has an epoch counter.
>> 
>> If a client tries to establish a DTLS connection and a MITM intercepts
>> it, establishes itself a DTLS connection, the epoch is 1. There will be
>> a final mismatch in the epoch and the packets will be discarded. When
>> using the RI extension one could enforce the sending of the alert message.
>> But the original attack is not possible, I think.
>> 
>> Is my analysis correct or am I overlooking something?
> 
> Can MitM do the same number of renegotitations as he does with the
> server before splicing him?
Good point, I missed that. So DTLS is also affected.

Could we then make it clear the that the RI extension applies to
TLS and DTLS?

Best regards
Michael
> 
> - Marsh
> 
>