Re: [TLS] A not-so crazy idea

[Michael D'Errico <[e-mail]>]

Nicolas Williams wrote:
> On Sat, Nov 14, 2009 at 08:08:35PM -0800, Michael D'Errico wrote:
>> Here's a crazy idea: we could define a completely incompatible change
>> to the way Finished messages are calculated even on initial handshakes.
> 
> Not on initial.  My proposal is to do it only on re-negotiate.

Doing it on initial is necessary to protect clients when the server is
not patched.

Remember that the attack happens on the client's INITIAL handshake!
We need to protect that handshake, and no other proposal does that
reliably.  Simply finishing the initial handshake completes the attack.

Modifying the Finished calculation provides protection, but the best
part is that an upgraded server can reliably detect the following three
cases:

    1) client is unpatched
    2) client is patched
    3) a MITM tampered with the handshake

The server calculates both the old and the new client verify_data to
see which one matches.  If it matches the old (current) calculation, then
the server knows the client is not upgraded (case 1) and it will not allow
any renegotiations -- if this handshake IS a renegotiation, then there is
a MITM possible, so the renegotiation is refused.

If the client's verify data matches the new Finished calculation, then
the handshake is allowed to complete whether it is an initial handshake or
a renegotiation.  (The new verify_data would incorporate channel binding
info akin to the proposed RI extension.)

If neither matches, then there was tampering by a MITM.

Problems with RI:

The RI extension is attackable in many ways by a MITM.  It can be stripped
from the ClientHello or stripped from ServerHello.  If one side or the
other makes decisions based on the presence or absence of the extension,
then the MITM can control your behavior.  The MITM can simulate a server
"crash" by not forwarding the ServerHello, forging a fatal alert, or just
closing the connection.

And as has been pointed out there are numerous problems with requiring an
implementation to add support for extensions, and may not be possible if
the code only does SSLv3.

Changing the Finished calculation is much better since there is no other
change to the handshake, and does not modify anything about the bits on
the wire.  This is much more resistant to tampering by a MITM, and the
server can reliably detect it!

I think this is not such a crazy idea and should be given consideration.

Mike