Re: [TLS] assert TLSext in renego-ServerHello instead of disable renego

[Michael D'Errico <[e-mail]>]

>> The problem is that your initial handshake *is* the renegotiation!
>> (from the server's point of view)
> 
> I may well be confused, but: a handshake is a renegotiation if-and-only-if
> it is encrypted. Initial handshakes are in the clear. So there is no
> ambiguity, from either party's point of view, about whether a handshake
> is a renegotiation.

Your initial handshake is in the clear from you to the MITM, but it gets
sent over the already-secure connection from the MITM to the server, so
from the server's perspective you are renegotiating.  This is why you
have to send the Renegotiation_Info extension -- it let's the server
know that *you* think you are performing an initial handshake.  It can
then shut down the connection and save you from the attack.

Mike