Re: [TLS] Consensus Call for draft-ietf-tls-renegotiation-00.txt

[Geoffrey Keating <[e-mail]>]

Apple supports this draft, with the following modification:

The draft does not address the security issue for existing clients unless it requires that renegotiation occur only when the extension is present.  I suggest strengthening the language in 4.2 to read

To prevent such attacks, servers MUST NOT allow clients who do not offer the "renegotiation_info" extension to complete a renegotiation.  If the client initiated the renegotiation the server SHOULD respond to such requests with a "no_renegotiation" alert [RFC 5246 requires this alert to be at the "warning" level.]  If the server initiated the renegotiation the fatal "handshake_failure" alert is appropriate.

and delete the sentence 'Servers SHOULD follow this behaviour'.

With this modification, section 4.1.1 is redundant and may be deleted.  It is also possible to delete section 4.3 as with this modification, if the client is convinced to drop the extension, either servers support the draft and will refuse to renegotiate without the extension and are still secure, or don't support the draft and will ignore the extension, and so would be insecure anyway.