Re: [TLS] simplistic renego protection

[Eric Rescorla <[e-mail]>]

At Mon, 16 Nov 2009 15:20:00 +0100 (MET),
Martin Rex wrote:
> 
> Eric Rescorla wrote:
> > 
> > I don't agree with your analysis of code complexity, but even if
> > you were correct the implementation effort is in any case so
> > minimal compared to the size of the deployment problem
> > that it strikes me as largely irrelevant. Moreover, we already
> > have implementations of RI, so the marginal implementation
> > effort is even lower compared to doing something new.
> 
> There is obviously no surprise that those who have already implemented
> this proposal in secret have a bias towards using it.  Most of them
> are actually affected by the problem, because they offered TLS
> renegotiation on the server side.

Well, I don't know who "most of them" you're talking about is. I did
the original cut of the OpenSSL implementation and it's not like I 
operate a service that relies on TLS server-side renegotiation. I
just thought it would be a public service to write the code. I'm
sorry if that offends you.


> Please consider that you are asking a lot of other implementors,
> who do not have an implementation yet, and many of which are not
> actually vulnerable to the problem, to implement this.

I'm not saying any such thing. If you're not willing to do 
server side renegotiation I think it's perfectly appropriate
to make no changes to your implementation.


> For them, the difference between a TLS extension RI and a much
> smaller and more efficient extension-less solution can be
> very significant -- in particular when it comes to testing
> the server-side of the generic extensions handling.
> 
> 
> The amount of code changes for the extension-less solution is
> rather small, this is _NOT_ going to be a burden for the
> implementors that have experimenting with TLS extension RI.
> It will be LESS than a day of work for each codeline.

Yes, as I said above I consider the entire implementation effort
issue to be a complete red herring. I was merely observing
that if one takes it seriously it's not clear that it actually
cuts in the direction you are arguing.

-Ekr