Re: [TLS] WGLC: draft-ietf-tls-session-hash

[Yoav Nir <[e-mail]>]

> On Nov 24, 2014, at 1:58 PM, Stephen Checkoway <[e-mail]> wrote:
> 
> 
> On Nov 24, 2014, at 3:44 AM, Yoav Nir <[e-mail]> wrote:
> 
>> Third issue: Why can’t an attacker disable this protection by simply omitting the extension from both its ClientHello and ServerHello?  At least in the short term it won’t be practical to fail a handshake because the other side doesn’t support this extension. I guess the answer is that the ruse will work, but the other attacks mentioned in TRIPLE-HS will fail, but it’s not clear to me why. A can still proxy unchanged records from C to S if the connections are resumptions. Perhaps servers should be prohibited from resuming a session set up without this extension if the ClientHello does include the extension.
> 
> The draft currently says "Clients and servers SHOULD NOT resume sessions that do not use the extended master secret..." Are you saying you want that to be MUST NOT?

I missed that line.

What I was suggesting was that servers MUST NOT resume sessions that were negotiated without the extended master secret in handshakes that do have the extension.

Thinking it over now, I guess it would be better to have both lines, because there’s a significant performance penalty to prohibiting sessions resumption with all existing clients, and prohibiting the resumption where the attacker is not manipulating the handshake defeats the known attacks.

Yoav