Re: [TLS] TLSrenego - possibilities, suggestion for SSLv3

[Michael D'Errico <[e-mail]>]

>> A client that is performing an initial handshake does _not_ know
>> whether there is a security problem, therefore I'm very reluctant
>> to suggest clients to warn users when performing a traditional
>> initial handshake.
> 
> The client can determine if he is handshaking with an unpatched TLS
> server when he sees the Server Hello message without the RI extension.
> It sounds reasonable to me that the client might indicate this
> potentially-insecure situation in whatever UI or log facility the client
> application provides.

A MITM could remove the extension from the ServerHello to trick you into
thinking the server doesn't support it.  Unless you finish the handshake,
you won't know.  But if you do finish it, you could be attacked.  Very
insidious!

Mike