Re: [TLS] simplistic renego protection

[Michael D'Errico <[e-mail]>]

> The most simplistic approch to renego protection is
> 
>    1. the client signals that it is patched through a fake
>       ciphersuite ID in each ClientHello
> 
>    2. the client only supports secure renegotiation and
>       secure renegotiation is specified to change the definition
>       of the handshake message hash for renegotiation handshakes
>       to include the verify_data of the client.finished and
>       server.finished after the ServerHello.

No, this does not plug the hole.  The magic ciphersuite in (1)
requires that the server recognize it, i.e. it is patched.
Therefore it will not perform insecure renegotiation even
without seeing the ciphersuite (especially without seeing it).

And again the client's INITIAL handshake is the one that the
server sees as a renegotiation in Marsh's attack, so the fact
that the client won't REnegotiate (2) is unhelpful; the attack
has already completed.

Mike