Re: [TLS] simplistic renego protection

[Michael D'Errico <[e-mail]>]

Eric Rescorla wrote:
> At Tue, 17 Nov 2009 13:09:24 +0000,
> Stephen Farrell wrote:
>> Having watched the recent list traffic I find the above convincing.
>> I'd love to see a -01 of the above containing the changes EKR has
>> mentioned already, and then a WGLC on that.
> 
> I just submitted an -01 version of the draft. This includes the
> following changes:
> 
> 1. Clarification of the encoding of the extension per the issue
>    by Eric Young and Nelson Bolyard.
> 2. A bunch of discussion of fallback and the downgrade issue.
> 3. A SHOULD level requirement that implementations which simply
>    reject negotiation still provide an empty extension when
>    requested by the client, thus signalling that they have
>    been updated.
> 4. A new section 4.3.1 that describes a magic cipher suite
>    to be used to prevent downgrade attack on implementations
>    which fall back to no extensions on handshake failure.

You forgot to mention:

4.3.  SSLv3

    SSLv3 does not support extensions and thus it is not possible to
    securely renegotiate with SSLv3.  Deployments wishing to renegotiate
    securely will need to upgrade to at least TLS 1.0.

Is there some secret agenda to kill off SSLv3?  What is the point
of that?  SSLv3 accounts for more than one-in-five connections as
reported to this list.  There is an alternate proposal that does not
have this limitation, and is better in many other respects.  Why do
you keep pushing this one?

Mike