Re: [TLS] assert TLSext in renego-ServerHello instead of disable renego

[David-Sarah Hopwood <[e-mail]>]

David-Sarah Hopwood wrote:
> Michael D'Errico wrote:
>>> Suppose that the client sent an SSLv3 ClientHello
>>> with client_version = 3.1 (or higher). Assuming the server supports TLS,
>>> then TLS will be negotiated. So when the client sends the renegotiation,
>>> it knows that it is safe to send extensions. The attack is prevented as
>>> long as the renegotiating handshake uses the extension; it is not
>>> necessary for the initial handshake to have used it.
>> The problem is that your initial handshake *is* the renegotiation!
>> (from the server's point of view)
> 
> I may well be confused, but: a handshake is a renegotiation if-and-only-if
> it is encrypted.

Well, except when the ciphersuite specifies no encryption. I should have
said "if-and-only a ciphersuite other than TLS_NULL_WITH_NULL_NULL is in
effect".

> Initial handshakes are in the clear. So there is no
> ambiguity, from either party's point of view, about whether a handshake
> is a renegotiation.

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com