Re: [TLS] assert TLSext in renego-ServerHello instead of disable renego

[Eric Rescorla <[e-mail]>]

At Mon, 9 Nov 2009 21:35:57 +0100 (MET),
Martin Rex wrote:
> 
> Maybe a patched Server (one with support for secure renegotiation)
> should ALWAYS assert this extension in a renegotiation TLS handshake
> _with_ the verify_data of both server.finished and client.finished
> in the ServerHello -- including when the client didn't send the
> extension (maybe because the client didn't dare confusing an SSLv3 server).

This is forbidden by RFC 4366: servers can only send what the client
offers:

   Note that for all extension types (including those defined in the
   future), the extension type MUST NOT appear in the extended server
   hello unless the same extension type appeared in the corresponding
   client hello.  Thus clients MUST abort the handshake if they receive
   an extension type in the extended server hello that they did not
   request in the associated (extended) client hello.

-Ekr