Re: [TLS] Comments on draft-rescorla-tls-renegotiate

[Bodo Moeller <[e-mail]>]

On Nov 14, 2009, at 12:31 AM, Nicolas Williams wrote:
> On Sat, Nov 14, 2009 at 02:20:56AM +0000, David-Sarah Hopwood wrote:
>> Nicolas Williams wrote:
>>> Comments:
>>>
>>> 1) The rest of this comment can be ignored if the use of protocol
>>>   extensions in draft-rescorla-tls-renegotiate is deemed to not be a
>>>   problem.
>>>
>>>   [...]
>>
>> The problem is that this unnecessarily breaks cases in which the
>> possibility of attack couldn't have been prevented (because only
>> one of the client and server supports the extension), and in which
>> there may actually be no attack.
>
> That's a feature: for how do you know that "there may actually be no
> attack"??

In general, you don't -- but sometimes you don't care.

TLS is often used for opportunistic encryption (such as between SMTP  
servers that in many cases have no way to verify each other's  
certificate): If the client and server can encrypt, they'll do it to  
get protection at least against passive attackers; otherwise, they'll  
just fall back to unencrypted transmission.  It would be a shame to  
have protocol negotiation problems make them fall back to unencrypted  
mode, when the currently deployed protocols could give them the  
security they expect.

Bodo