Re: [TLS] simplistic renego protection

[Martin Rex <[e-mail]>]

[e-mail] wrote:
> 
> Martin Rex wrote:
> 
> > Does anyone remeber that the TLS WG gave the advice to people asking
> > for identity protection to perform an initial client-anonymous TLS
> > handshake directly followed by a renegotiation with client-cert
> > authentication?
> > 
> > (a related discussion what about gss-api authentication
> >  around 20-dec-2006, Subject: [TLS] Comments on TLS identity
> > protection)
> 
> Yes... and as Eric noted, as long as the 2nd handshake "directly
> follows" (=no application data is exchanged using the first session),
> this seems to be secure already....


But you do realize that there is an attack scenario where the server
sees only an initial authentication, and the client sees a renegotiation?

The MitM could use it to perform some kind of "bouncing-attack",
where it feeds the client with a crafted request (like a form)
and then links the client with the real server.

So it is necessary for both sides to check, a check on the server
alone is not sufficient.  And if we're changing code, we could
just as well deploy the fix for the weakness (provided TLS WG
can agree on one solution).


-Martin