Re: [TLS] assert TLSext in renego-ServerHello instead of disable renego

[David-Sarah Hopwood <[e-mail]>]

Michael D'Errico wrote:
>> Suppose that the client sent an SSLv3 ClientHello
>> with client_version = 3.1 (or higher). Assuming the server supports TLS,
>> then TLS will be negotiated. So when the client sends the renegotiation,
>> it knows that it is safe to send extensions. The attack is prevented as
>> long as the renegotiating handshake uses the extension; it is not
>> necessary for the initial handshake to have used it.
> 
> The problem is that your initial handshake *is* the renegotiation!
> (from the server's point of view)

I may well be confused, but: a handshake is a renegotiation if-and-only-if
it is encrypted. Initial handshakes are in the clear. So there is no
ambiguity, from either party's point of view, about whether a handshake
is a renegotiation.

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com