Re: [TLS] SCSV vs RI when both specified. Was: Updated draft

[Marsh Ray <[e-mail]>]

Steve Dispensa wrote:
> 
> Now, of course, it's a client attack at that point, not a server attack,
> so one might reasonably wonder whether it's the server's responsibility
> to defend against it.

If it were a buffer overflow in the client or server code, then it would
be a client- or server-specific attack.

In this case, it's doable with ordinary valid protocol structures and at
least one case doesn't depend on the particulars of the implementation
of either side. To me, that makes it a protocol attack.

Turn it around: Consider the demonstrated attack where MitM renegotiated
with the Twitter server and caused the user of the client to publicly
tweet his own password. Just because it was the server which saw the
renegotiation does that make it only the concern of the server? A year
from now, will you be willing to conduct your online banking with an
unpatched server on the logic that it's "not my responsibility"?

Again, TLS is a general-purpose network data security protocol that's
supposed to offer some basic guarantees. Any break in those guarantees
is a break in the protocol. Whether or not the loss of any specific
guarantee represents a significant problem for a specific party using
some specific application layer protocol is irrelevent to the security
analysis of TLS.

- Marsh