Re: [TLS] simplistic renego protection

[Marsh Ray <[e-mail]>]

Nasko Oskov wrote:
> 
> Just an idea for signaling, since we are enumerating ideas.

My opinions:

We should use two bits in each direction:
0. "I'm patched"
1. "I'm lenient"
both default to false.

For signaling in the Client Hello I like the superfluous cipher suites
idea. Unless there are likely to be problems with advertising a new
cipher suite.

For the Server Hello I don't think there are any good options. The only
bits in there which are defined to not have any existing semantics are
the random_bytes (not the gmt_unix_time).

We should take 4 contiguous bytes from somewhere in the middle of the 28
random bytes, and interpret them as a uint32. In this new area we use
the bottom two bits as flags, and zero out the rest. These flags should
be sent regardless of whether or not the client requested it.

It is no one's first choice to destroy entropy from the random_bytes.
However, it seems there is little alternative. The remaining 24 bytes
still represent a generous amount.

Although this pattern of 30 contiguous zeros could occur randomly, it
would be a 1-in-one-billion occurrence.

- Marsh