Re: [TLS] Comments on draft-rescorla-tls-renegotiation-01.txt

[Kyle Hamilton <[e-mail]>]

On Tue, Nov 24, 2009 at 4:34 PM, Martin Rex <[e-mail]> wrote:
> Kyle Hamilton wrote:
>>
>> 4.3.1:
>> Clients which choose to fall back to an extensionless mode of
>>    operation MUST include the magic cipher suite [TBD] in any such
>>    handshake.  Servers MUST reject any ClientHello which uses this
>>    cipher suite but does not include RI with a fatal "handshake_failure"
>>    alert.  Because servers ordinarily ignore unknown cipher suites, this
>>    cipher suite can be added safely on any handshake, thus allowing
>>    detection and prevention of the MITM attack described above.
>>
>> The only issue I see is... we've got an issue in signalling back to
>> the client that it knows how to do the updated handshake.  Would a
>> slightly modified HelloRequest do it?
>
> Aha.  Someone noticed that the S->C signaling is missing.
>
> I suggest using a bit in ServerHello.server_version.

I don't think that many conforming clients are going to be okay with
that, since they're sending {0x03 0x04}, and you're having the server
send back {0x83 0x04} or {0x03 0x84}.

The spec of TLS 1.0 implies that the client SHOULD terminate the
connection if it receives back a higher major version number (or minor
version number) than it was expecting.  It is specified as "the lower
of the client-suggested protocol version, and the protocol version
supported by the server".  It would be very easy to (falsely, in this
case, but that doesn't matter) identify it as an MITM with a version
modification attack going on.

I think that conforming, unpatched TLS 1.0 implementations will
terminate connections if they see a major version of 131, or a minor
version of 132.

-Kyle H

>
> So far, the magic cipher suite idea in TLS extension RI
> is a "solution" to the downgrade vulnerability
> from the automatic reconnect fallback in TLS clients.
>
> So as far as SSLv3 support is concern, TLS extension RI
> is still firmly determined to exterminate SSLv3  and with the
> magic cipher suite, it'll kill conservative TLS clients along with it.
>
> -Martin
>
>
>