Re: [TLS] A not-so crazy idea

[Nicolas Williams <[e-mail]>]

On Sun, Nov 15, 2009 at 10:39:35AM -0800, Michael D'Errico wrote:
> Nicolas Williams wrote:
> >On Sat, Nov 14, 2009 at 08:08:35PM -0800, Michael D'Errico wrote:
> >>Here's a crazy idea: we could define a completely incompatible change
> >>to the way Finished messages are calculated even on initial handshakes.
> >
> >Not on initial.  My proposal is to do it only on re-negotiate.
> 
> Doing it on initial is necessary to protect clients when the server is
> not patched.
> 
> Remember that the attack happens on the client's INITIAL handshake!
> We need to protect that handshake, and no other proposal does that
> reliably.  Simply finishing the initial handshake completes the attack.

True.  The server can always screw the client anyways, so the client has
to trust server correctness, but, atleast in this case it'd be nice to
have a critical indication in the initial handshake.  That can be done
with or without extensions, but if without extensions then clients will
need to do the ugly fallback dance.

Nico
--