Re: [TLS] SCSV vs RI when both specified. Was: Updated draft

[Martin Rex <[e-mail]>]

Steve Dispensa wrote:
> 
> On Jan 12, 2010, at 9:17 AM, Marsh Ray wrote:
> 
> > Martin Rex wrote:
> >>
> >> There is absolutely _NO_ known security problem and no  
> >> vulnerability for
> >> a server to accept an initial handshake with the existing SSLv3,  
> >> TLSv1.0,
> >> TLSv1.1 or TLSv1.2 protocol, even when the ClientHello handshake
> >> message does neither contain SCSV nor an empty extension RI.
> >
> > Baloney!

Steve and Marsh.

There is a document, approved by the IESG, where both of you are listed
as document co-authors, and it says this:

http://tools.ietf.org/html/draft-ietf-tls-renegotiation-03#section-4.3

   4.3. Server Considerations

   If the client does not offer the "renegotiation_info" extension or
   the TLS_RENEGO_PROTECTION_REQUEST SCSV then this indicates that the
   client does not support secure renegotiation.  However, because the
   above attack looks like two handshakes to the server, the server can
   safely continue the connection as long as it does not allow the
   client to renegotiate. 

I'm fine with that "the server can safely continue the connection as long
as it does not allow the client to renegotiate."

I don't want to continue discussing this issue.

-Martin