Re: [TLS] TLSrenego - possibilities, suggestion for SSLv3

[Martin Rex <[e-mail]>]

Marsh Ray wrote:
> 
> Yair Elharrar wrote:
> > Martin Rex wrote:
> > 
> > It would probably be better if the entire 32-bit gmt_unix_time was
> > set to one of two predefined magic values:
> 
> Do you know that nothing cares about the actual time encoded?
> 
> Why burn 32 bits of entropy to represent one bit?

Yair's suggestion is actually 3 states (~1.5 bits)
   initial, renegotiation, unknown

but other than that, it also seems like waste to me to re-purpose
the _entire_ 32-bits.

> 
> > one indicating an initial
> > connection ('INIT'), the other indicating a renegotiation ('RNEG'). A
> > client receiving 'RNEG' on an initial handshake would know the
> > session is under attack. A client receiving 'INIT' on an initial
> > handshake would know the session is safe. Any other value would
> > indicate the server is running an insecure implementation.
> 
> The problem still exists between sessions (2,3) (3,4) and so on.

New clients should not renegotiate with servers that lack the
secure renegotiation extension.  There is no problem with clients
participating an initial handshake with these, provided that they
can distinguish initial from renegotiation handshakes performed
by the server.


-Martin