Re: [TLS] simplistic renego protection

[Stefan Santesson <[e-mail]>]

On 09-11-20 7:41 PM, "David-Sarah Hopwood" <[e-mail]>
wrote:

>> One example is if authentication is performed with proper channel binding in
>> a layer above TLS and the service is provided under that security context.
> 
> I'm skeptical. How can "proper channel binding" be done correctly in a
> layer above TLS, if the TLS library merges renegotiated sessions?
> Since the session merging will result in the client and server's state
> at the higher layer(s) being out of sync, nothing can be assumed about
> the correct functioning of those layers.

The problem occurs on the clients initial handshake, being done in the
clear, while the MITM is feeding this into a renegotiation with the server.

As this attack has been described, once the client and server has concluded
an end-to-end handshake, the window for the attacker to do bad stuff is
closed. All renegotiations are safe from this point on.

The very act of channel binding, binds authentication of the client to
unique properties of the TLS channel. Thus,  successful channel binding
ensures that the client has concluded its first handshake (or it would not
have anything to bind to). It also ensures that the TLS channel is carried
end-to-end (or else channel binding would fail).

So according to the logic above, successful channel binding would prove that
the window for the attacker to do bad stuff is gone.

/Stefan