Re: [TLS] simplistic renego protection

[Bill Frantz <[e-mail]>]

[e-mail] (Ben Laurie) on Saturday, November 21, 2009 wrote:

>The depends on those layers. If, for example, clients and servers simply
>numbered their requests/responses, they would be immune to the attack.

and [e-mail] (Stefan Santesson) on Saturday, November 21, 2009 wrote:

>Or do you mean that it is impossible to design an application to be safe?

While it is possible to design an application protocol which is safe, it
isn't easy. For example, both the server and the client have to be using
the same <begin request> <end request> brackets. An attack on HTTP depends
on allowing the MITM to cause the server to process a different GET/POST
request from the one the client sent.

This bracketing issue affects even protocols like the Waterken
<http://waterken.sourceforge.net/> web-key protocol, where each request is
self-authorizing. If the MITM has a resource on the server addressable with
a web key, he can cause the client to pass parameter web-keys to that
resource rather than the resource the client thought it was addressing.

As a proof of concept that it is possible to design a safe protocol, if
each request is digitally signed by the sender, and verified by the
receiver, the MITM can not introduce superfluous data into the
conversation. If the brackets are different, the signatures don't verify.

Cheers - Bill

-------------------------------------------------------------------------
Bill Frantz        | Airline peanut bag: "Produced  | Periwinkle
[phone]      | in a facility that processes   | 16345 Englewood Ave
www.pwpconsult.com | peanuts and other nuts." - Duh | Los Gatos, CA 95032