Re: [TLS] simplistic renego protection

[David-Sarah Hopwood <[e-mail]>]

Martin Rex wrote:
> There are going to be components out there that will not get
> patched.  They might not implement renegotiation (or have it
> disabled) and they're therefore not even vulnerable.
> 
> But we can not simply brick them (deny to talk SSL to them
> in the future).
> 
> So Browsers will likely have to continue to offer an fallback
> to extension-less ClientHello.

This is a non-sequitur. Lenient clients don't need to send the
extension in the ClientHello of an initial handshake. Strict clients
must not be able to talk to unpatched servers, by definition.

Unpatched servers *will* eventually be "bricked", as you put it,
if they stay unpatched as an increasing proportion of clients
adopt a strict policy. There is no possible solution to that other
than patching all servers, including those that don't support
renegotiation. This is true also for the proposed alternatives
to RI.

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com