Re: [TLS] Redefine Finished message for TLS 1.3 ?

[Martin Rex <[e-mail]>]

Michael D'Errico wrote:
> 
> > The more I think about it, the more I'm opposed to using
> > TLS extensions to wrap this fix.  It's just to urgent and serious
> > to spend such an amount of time on a fancy wrapping.
> 
> I'm OK with whatever the fix becomes, but just want to point out
> that changing the Finished message calculation for renegotiations
> does not protect a patched client when talking to an unpatched
> server.

The negotiation (=signaling C->S and more importantly S->C) in
ClientHello and ServerHello is what clients can use to protect
themselves.  They can warn or decide to not talk to servers
that are not patched at some point in the future.

An warning popup is a suitable method to apply market pressure.

A lack of interoperability is not a suitable method,
it is rather a sign of poor engineering.


All Browsers that added newer TLS versions and the TLS extension SNI
also had to add an app-level reconnect fallback because of the
resulting interop problems.


If we wrap this fix into a TLS extension, then every recipient of that
fix will encounter the very same interop problems as the Browser
vendors/implementors.

This will result in annoyed customers, many support calls,
some apps will be enhanced to also add re-connect fallbacks,
but overall it will significantly slow down the adoption of
the patch -- instead, the workaround to take countermeasures
to TLS renegotiation will then effectively kill renegotiation.


I think it is neither reasonable nor justified to cause so much
pain when it is possible to fix the problem with significantly
less resulting interop problems by _NOT_ using a TLS extension.



Side note: I do think we should add 1 page of guidance to
implementors in the final document outlining what implementors
should really check and fix when they touch code in order to
implement the fix for TLS renegotiation.

  - how to correctly process a ClientHello with additional data
    (all protocol version SSLv3->TLSv1.2)

  - how to correctly process the protocol version fields in
    the handshake messages and record protocol.

(but really only 1 page).

-Martin