Re: [TLS] To extend or not to extend

[Nelson B Bolyard <[e-mail]>]

On 2009-11-15 14:22 PDT, Bodo Moeller wrote:
> On Nov 15, 2009, at 1:14 PM, Nelson B Bolyard wrote:
> 
>> On 2009-11-15 03:38 PDT, Eric Rescorla wrote:
>>
>>> So, thinking further on my earlier message, I think the following
>>> elaboration will work a bit better:
>>>
>>> - Strict clients (those which wish to insist on RI) generate RI on
>>>  initial handshake. As I said earlier, I don't think this is
>>>  useful, but it works.
>>>
>>> - Lenient clients do not generate RI on initial handshake but do
>>>  generate it on rehandshake with TLS 1.0+ only.
>>>  + Moderately lenient clients can fail if the server does not
>>>    do RI.
>>>  + Really lenient clients can ignore the server's failure to
>>>    do RI.
>> Aren't your so-called Lenient clients still 100% vulnerable to the  
>> attack?
>>
>> What prevents their initial handshakes from being used by an  
>> attacker as renegotiations with a vulnerable server?
> 
> Not connecting to a vulnerable server would.  In the web browser  
> scenario, if I know that the HTTPS servers I use for serious purposes  
> are not vulnerable (i.e. don't allow renegotiation, other than  
> possibly with the updated renegotiation protocol), I'm fine.

Right.  In the presence of a "white list" of known invulnerable servers,
no client protocol modifications of any kind are necessary.


> When an HTTP page points me to an HTTPS page that I haven't heard of  
> before, where I wouldn't even bother to verify the certificate's  
> subject name or the hostname, then I don't care at all: 

Right.  That case is not interesting.

The interesting case is the server that you have heard of before, and do
use, perhaps with some frequency, but you do not know if it is vulnerable
or not.  Since you are a regular user of that server, if it is vulnerable
then the next time you use it, you may be vulnerable, too.  As a lenient
client of that server, you have no protection from the attack.