Re: [TLS] Handshake not under protection

[Marsh Ray <[e-mail]>]

Ravi Ganesan wrote:
> 
>     Ravi, your terminology is slightly confusing.  Renegotiation refers
>     to a TLS handshake that is performed under protection of an existing
>     TLS session, so the two things you could distinguish are:
> 
> Martin, Point well taken. Thx, Ravi
> 
> p.s. I prefer not to think of the handshake happening "under protection"
> of previous session. Another example of this is in current draft which
> says: "The handshake is in the clear to the attacker but encrypted over
> the attacker's TLS connection to the server." The handshake itself is
> always of course is in the clear, certain values in it are encrypted
> with certain keys. And in some cases this results in binding to previous
> sessions. This sounds nitpicky, but I only say this because perfectly
> smart security people with some knowledge of SSL can read sentences like
> above to assume the entire handshake (including client_random and
> server_random) is encrypted.

+1.

There is no "protection" being provided. People who are thinking
renegotiation provides real security for client certificates are
somewhat misguided.

At the TLS level, it's possible for the current session to be
anon-anon-DH, which provides no protection.

In practice, client apps will hand over the plaintext client certificate
to any MitM that asks for it.

- Marsh