Re: [TLS] assert TLSext in renego-ServerHello instead of disable renego

[Eric Rescorla <[e-mail]>]

At Tue, 10 Nov 2009 09:08:20 -0800,
Michael D'Errico wrote:
> A client that wants protection from this attack MUST send the extension
> in its initial handshake.  Why don't you want to do that?
> 
> The attack being discussed happens on the client's *initial* handshake.
> The server sees it as a renegotiation, so the client needs to be able to
> tell the server that it thinks it is performing an initial handshake.
> That is exactly what this extension provides.  If you don't send the
> extension on an initial handshake you are risking being attacked.

I don't see that that's the case: you're risking being attacked in
any case if the server is not upgraded.


> All servers SHOULD disable renegotiation to protect clients, but it's
> been said that this is impractical.  A server may be configured to allow
> renegotiation even though it understands the new extension.  Thus by not
> sending the extension in your initial handshake, you are just as
> vulnerable, even though you could have prevented an attack.

I don't really agree with this: servers which allow renegotiation without
this extension are unwise.

-Ekr