Re: [TLS] Proposed text for removing renegotiation

[Nikos Mavrogiannopoulos <[e-mail]>]

On Tue, 2014-06-10 at 10:53 -0400, Salz, Rich wrote:
> > Could you please cite these security issues. In the 17 years of the protocol I have only seen one.
> 
> Which one are you omitting -- Marsh's  or triple-handshake?

The triple handshake identified many issues in TLS but no issue in the
renegotiation. Renegotiation cannot solve the protocol's vulnerability
the triple handshake exploits.

Nevertheless, you can see the importance of renegotiation in the triple
handshake attack  by checking the preconditions for the attack. The
authors on their website clarify on the vulnerabilities they identified
and quoting them for renegotiation: "During renegotiation, both the
server and client certificates can change. This is allowed by TLS (and
supported in its main implementations) but no definitive guidance is
given to applications on how to deal with such changes".

Mentioning the lack of application level guidance (for applications that
need and make use of it) as a reason to drop renegotiation, is a bit far
fetched.

regards,
Nikos