Re: [TLS] simplistic renego protection

[Martin Rex <[e-mail]>]

David-Sarah Hopwood wrote:
>
> I agree completely; the implementation effort for approaches
> using extensions is not significantly greater than for any other
> signalling mechanism. For the subset of implementations that
> already support extensions, it is less.

Looking at the code for TLS extensions in openssl-0.9.8g
your statement seems wrong.  It's more.

And if a codebase doesn't have extensions yet, it is significantly
more, because extensions is a generic container and there may
be more than one.

The latter is also a reason why interop testing becomes a magnitude
more complex, because you need to interop-test a huger number of
possible combinations.  Not necessarily for existing extensions code,
but definitely for extensions code that needs to be implemented first
time just for this fix.


It is extremely unwise to ask especially the maintainers of _old_ code,
who are most likely not even vulnerable (lacking server-side renegotiation
entirely), to add generic TLS extensions code and build themselves a
test client that can simulate all the various combinations possible
with TLS extensions in order to test they're processing it correctly.


-Martin