Re: [TLS] assert TLSext in renego-ServerHello instead of disable renego

[Michael D'Errico <[e-mail]>]

Eric Rescorla wrote:
> At Tue, 10 Nov 2009 09:08:20 -0800,
> Michael D'Errico wrote:
>> A client that wants protection from this attack MUST send the extension
>> in its initial handshake.  Why don't you want to do that?
>>
>> The attack being discussed happens on the client's *initial* handshake.
>> The server sees it as a renegotiation, so the client needs to be able to
>> tell the server that it thinks it is performing an initial handshake.
>> That is exactly what this extension provides.  If you don't send the
>> extension on an initial handshake you are risking being attacked.
> 
> I don't see that that's the case: you're risking being attacked in
> any case if the server is not upgraded.

My point was that if the server *is* upgraded and the client does not
send the extension on its initial handshake, it is taking an unnecessary
risk.  It is relying on the server to not continue with an insecure
renegotiation.  While this is the recommended advice, it might not be
followed for practical reasons (as others have pointed out).  Therefore,
the client has just shot itself in the foot -- it had the knowledge of
how to avoid the attack but didn't use it.

>> All servers SHOULD disable renegotiation to protect clients, but it's
>> been said that this is impractical.  A server may be configured to allow
>> renegotiation even though it understands the new extension.  Thus by not
>> sending the extension in your initial handshake, you are just as
>> vulnerable, even though you could have prevented an attack.
> 
> I don't really agree with this: servers which allow renegotiation without
> this extension are unwise.

Right, but it will take a (long?) while before everybody can behave
according to the recommendations.

Mike