Re: [TLS] simplistic renego protection

[Martin Rex <[e-mail]>]

Joseph Salowey wrote:
> > 
> > I really like to hear convincing arguments why we need the 
> > TLS extension in the renegotiation handshake, and why 
> > changing the definition for the handshake message hash 
> > instead is not a superior alternative.  In particular one 
> > that will grow naturally into future TLS revisions.
> 
> [Joe] TLS Extensions is the standard way to extend the protocol.  Using
> the ciphersuite field as a means to change the base protocol is a new
> extension mechanism.  I don't think this is a particularly good thing
> for TLS to grow into.  I don't see a reason to define a new extension
> mechanism when we can achieve what is necessary using the existing
> mechanism.   When TLS 1.2+x is defined in the future then it can address
> the renegotiation problem as necessary and the version field will signal
> the underlying changes.   


You do not seem to understand the TLS renegotiation problem at all.

We are NOT supposed to extend TLSv1.2, we are supposed to FIX
all protocol versions of TLS out there SSLv3->TLSv1.2.

The TLS extensions mechanism is completely irrelevant to the problem
and completely unnecessary for the fix.


Requiring people to implement generic TLS extensions, something
that was completely undefined even for TLSv1.0 and is still optional
in TLSv1.2, only to fix something that has nothing to do with
TLS extensions and can be fixed much more easily without TLS extensions
is a pretty bad idea and poor engineering.


Think about the lines of code for a client:

minimum:

1  Memorizing the verify_data from the last finished messages
   (extend the session structure to keep a copy)
   2x memcpy()
   one after creating client.finished and after verifying server.finished.

2  add the verify_data to the handshake message hash for renego
   1x if ()  plus 2x  add_to_handshake_message_hash(previous.verify_data)
   after processing server hello


extra: the handshake

3  add the fake ciphersuite ID to the clients ciphersuite list
   can be as simple as adding an entry to a statically comiled structure,
   but 5 statements to add it dynamically is still ok

4  check the ServerHello for the server-signal to decide wether to abort
   talking to an unpatched server
   1x if  ( ... server_version ...)  {  send_alert( ) ; goto error }


more extra: still talk to old servers if config permits it

5  config parsing

6  put a second condition into the if() in (2)



The TLS extensions stuff requires at least 3x the amount of code,
is a complete waste for the code and for the network bandwidth.


Just dump the completely unnecessary TLS extension gift wrapping
for the fix and get over it.


-Martin