Re: [TLS] Comments on draft-rescorla-tls-renegotiation-01.txt

[Martin Rex <[e-mail]>]

Kyle Hamilton wrote:
> 
> 4.3.1:
> Clients which choose to fall back to an extensionless mode of
>    operation MUST include the magic cipher suite [TBD] in any such
>    handshake.  Servers MUST reject any ClientHello which uses this
>    cipher suite but does not include RI with a fatal "handshake_failure"
>    alert.  Because servers ordinarily ignore unknown cipher suites, this
>    cipher suite can be added safely on any handshake, thus allowing
>    detection and prevention of the MITM attack described above.
> 
> This is absolutely essential.  TLS extensions exist, but SSL 3 is
> still commonly used.  There's no reason why SSL 3 shouldn't benefit
> from anything that happens after-the-fact, even though it was never an
> actual IETF protocol.
> 
> The only issue I see is... we've got an issue in signalling back to
> the client that it knows how to do the updated handshake.  Would a
> slightly modified HelloRequest do it?

Aha.  Someone noticed that the S->C signaling is missing.

I suggest using a bit in ServerHello.server_version.

So far, the magic cipher suite idea in TLS extension RI
is a "solution" to the downgrade vulnerability
from the automatic reconnect fallback in TLS clients.

So as far as SSLv3 support is concern, TLS extension RI
is still firmly determined to exterminate SSLv3  and with the
magic cipher suite, it'll kill conservative TLS clients along with it.

-Martin