Re: [TLS] draft-ietf-tls-renegotiation-01.txt and DTLS

[Eric Rescorla <[e-mail]>]

At Mon, 30 Nov 2009 12:06:02 -0600,
Marsh Ray wrote:
> 
> Michael Tüxen wrote:
> > 
> > If I'm not wrong, then the attack which works against TLS does not
> > work against DTLS, since DTLS has an epoch counter.
> > 
> > If a client tries to establish a DTLS connection and a MITM intercepts
> > it, establishes itself a DTLS connection, the epoch is 1. There will be
> > a final mismatch in the epoch and the packets will be discarded. When
> > using the RI extension one could enforce the sending of the alert message.
> > But the original attack is not possible, I think.
> > 
> > Is my analysis correct or am I overlooking something?
> 
> Can MitM do the same number of renegotitations as he does with the
> server before splicing him?

Nagendray and I had this conversation last week. While I haven't done
a complete analysis, my intuition is that DTLS is more resistant (for
the reason you indicate) but not 100% resistant.  Another concern
would be epoch rollover: what if you do 65536 (65535?--too lazy to
calculate) handshakes with the server and force the epoch back to 0?

So, probably better to use RI with DTLS as well.

-Ekr