Re: [TLS] TLS Digest, Vol 65, Issue 88

[Martin Rex <[e-mail]>]

Ravi Ganesan wrote:
> 
> >
> > Ravi, your terminology is slightly confusing.  Renegotiation refers
> > to a TLS handshake that is performed under protection of an existing
> > TLS session, so the two things you could distinguish are:
> >
> >  - renegotiation with a full handshake
> >  - renegotiation with an abbreviated handshake (aka session resume)
> 
> I prefer not to think of the handshake happening "under protection" of
> previous session. Another example of this is in current draft which says:
> "The handshake is in the clear to the attacker but encrypted over the
> attacker's TLS connection to the server." The handshake itself is always of
> course is in the clear, certain values in it are encrypted with certain
> keys. And in some cases this results in binding to previous sessions. This
> sounds nitpicky, but I only say this because perfectly smart security people
> with some knowledge of SSL can read sentences like above to assume the
> entire handshake (including client_random and server_random) is encrypted.


We might be talking past each other to some extent.

For a renegotiation handhshake, the entire handshake is encrypted,
including client_random and server_random, which means that anybody
watching it on the network can not see anything else than the
TLS record protocol on the outside (but he can see the ContentType
of the records).

The communication peers can decrypt the communication, of course.
In the specific case of the one attack described in
draft-ietf-tls-renegotiation the MitM encrypts the handshake data
received from the peer and sends it to the server into a renegotiation
handshake, and the MitM decrypts all handshake data received from
the server and sends it to the client in the clear.

If you discount the special case of the RSA-encrypted premaster secret,
there are _no_ values in the handshake data that are encrypted
"with certain keys".

In the SSL&TLS design, encryption of the communication happens exclusively
at the record layer (using records with sequence numbers).

-Martin