Re: [TLS] simplistic renego protection

[Stefan Santesson <[e-mail]>]

On 09-11-21 8:00 PM, "David-Sarah Hopwood" <[e-mail]>
wrote:

> 
> That's an oversimplification.
> 
> The attacker is able to add a prefix to the server's view of the session.
> This changes the server's state from what it would have been on an
> initial connection. How far the attacker's influence on the server's
> state extends into that session, is dependent on the application protocol.

So we are saying the same thing.

As you say, it depends on the application. What I claim is that it is
possible to design an application that use channel binding to keep itself
safe from this attack. All it needs to do is to make sure that it's state is
reset after completed channel binding.

The fact that it is possible to be safe despite this vulnerability is an
argument that lenient servers should be supported in the solution.

If I analyze my application and determine that it is safe from the attack,
then I could just allow gradual upgrades and stay lenient.

Or do you mean that it is impossible to design an application to be safe?

/Stefan