Re: [TLS] SCSV vs RI when both specified. Was: Updated draft

[Marsh Ray <[e-mail]>]

Martin Rex wrote:
> Marsh Ray wrote:
>> Martin Rex wrote:
>>>
>>> TLS_RENEGO_PROTECTION_REQUEST is a request from the client to the
>>> server to perform a secure handshake and confirm this by sending
>>> TLS extension RI in ServerHello.
>> But what does that mean? What is "a secure handshake" if you're not
>> sending the RI extension? To the extent that this document is describing
>> how to perform a secure handshake, that definition is circular.
> 
> "A secure handshake" is one where client and server will check
> whether the contents of the TLS renegotiation RI match the
> verify_data from the Finished messages from the enclosing TLS session
> and TLS peers should abort the handshake if the conveyed information
> does not match.  The presence of an empty TLS extension RI in ClientHello
> is obviated by presence of SCSV in this ClientHello handshake message.

OK, let's see how that definition passes the substitution test:

"TLS_RENEGO_PROTECTION_REQUEST is a request from the client to the
server to perform a handshake where client and server will check whether
the contents of the TLS renegotiation RI match the verify_data from the
Finished messages from the enclosing TLS session and TLS peers should
abort the handshake if the conveyed information does not match and
confirm this by sending TLS extension RI in ServerHello."

Hmm, complete nonsense. That definition talks about how RI data is
interpreted which is the antithesis of what SCSV is about.

Come up with a way to complete a sentence that begins with
"TLS_RENEGO_PROTECTION_REQUEST is" or "SCSV means" such that it
describes the three cases for it in a reasonably consistent way.

Real difficulties in doing this is, in my experience, a pretty good sign
that something is wrong with a design.

I think this is possible to do with wording (I) and much more
challenging with the others.

> Do not try to describe scenarios.  That is completely unecessary,
> very confusing and you may easily get the description of one of
> the cases wrong and cause confusion among implementors.

So you can't define SCSV, and I can't enumerate the scenarios where it
can be used either?

> The implementer's feedback was:
> In order to implement this MUST NOT I have to add two extra conditionals
> to the code, and I have to build test cases to check whether that doesn't
> break anything and whether I am compliant -- but in reality these
> two conditionals are completely useless, they do not add any value
> to the protocol and neither to the security.

I would build those test cases anyway.

Having all cases defined and handled in an intentional way (even where
they are defined to be ignored) is a good thing and inherently valuable.
Perhaps nowhere more so than in the TLS initial hello handshaking.

- Marsh