Re: [TLS] A crazy idea

[Michael D'Errico <[e-mail]>]

There could be an initial roll-out of patched servers, configured to
respond to both patched and unpatched clients, but to not perform
renegotiation with unpatched clients.  Once sufficient time has
passed, patched clients can be rolled out, followed by turning off
compatibility mode in servers.

Clients that currently do not have reconnect logic would not need to
add it.

Mike


Marsh Ray wrote:
> Michael D'Errico wrote:
>> Here's a crazy idea: we could define a completely incompatible change
>> to the way Finished messages are calculated even on initial handshakes.
> 
> Or it could be as simple as flipping one bit in the verify_data.
> 
>> A client can initially try connecting using the new Finished message
>> calculation, and if that fails, fall back to the original (if it's
>> willing to risk talking to an unpatched server).
> 
> We can't change the app code.
> 
>> The server has the advantage of receiving the client's Finished message
>> before it needs to send its own, so it can compute both the new and the
>> old versions to see which the client supports.  Then it can decide
>> whether to continue with the handshake or abort.  This also thwarts any
>> tampering by a MITM since neither calculation would match if messages
>> were altered.
>>
>> For session resumption, each side would need to remember whether the
>> new or the old Finished calculation was used.
>>
>> Just throwing the idea out there....
> 
> We need all the ideas we can get.
> 
> Really, I think the harder problem is signaling in the initial hellos,
> particularly the server hello. We need one unambiguous bit in each
> direction, with a consistent default from unpatched endpoints.
> 
> - Marsh