Re: [TLS] simplistic renego protection

[Michael D'Errico <[e-mail]>]

>> And again the client's INITIAL handshake is the one that the
>> server sees as a renegotiation in Marsh's attack, so the fact
>> that the client won't REnegotiate (2) is unhelpful; the attack
>> has already completed.
> 
> Bugs of the server must be fixed at the server.  You can not expect
> from end users that they will have every piece of TLS client software
> that they might be using reviewed before the dare touching it.

I don't know where you got the idea I was talking about buggy servers.

The attack requires that there be a man-in-the-middle between the
client and server.  The MITM handshakes once with the server.  The
client then handshakes with the server via the MITM, so:

   - the client sees the handshake as its initial handshake
   - the server sees the handshake as a renegotiation

This is the point: the client is attacked on its *initial* handshake.

Therefore the client needs to be protected on its *initial* handshake.

It doesn't matter what happens after that.  If the client has completed
its initial handshake and there was no MITM, it is impossible for a MITM
to insert itself in the next handshake (i.e. a renegotiation).  So from
the client's point of view the only handshake it needs to be concerned
with (in terms of security not mechanics) is the initial one.

Mike