Re: [TLS] simplistic renego protection

[<[e-mail]>]

Martin Rex wrote:

> > Yes... and as Eric noted, as long as the 2nd handshake "directly
> > follows" (=no application data is exchanged using the first session),
> > this seems to be secure already....
>
> But you do realize that there is an attack scenario where the server
> sees only an initial authentication, and the client sees a
> renegotiation?

Hmm... you're right, this could happen. But only if the client is OK
with the server changing its certificate during renegotiation, and
both certificates are accepted by the client.

Having TLS endpoints change their certificates during renegotiation is
highly likely to confuse many applications (and lead to security
problems) even when the renegotiation is secure (i.e. there's no MitM,
just the two endpoints). Draft-ietf-tls-renegotiation-00 requires that
even clients/servers that do implement secure renegotiation MUST NOT
by default allow certificate changes during renegotiation (unless the
application especially asks for it, and is prepared to handle such
changes).

Best regards,
Pasi
(not wearing any hats)