[TLS] Way to go everybody! TLS FTW!

[Marsh Ray <[e-mail]>]

Today, this "Patch Tuesday", Microsoft releases KB980436 which adds 
support for RFC 5746 the Renegotiation Indication Extension
http://www.microsoft.com/technet/security/bulletin/ms10-049.mspx
This is a major accomplishment, Microsoft clearly has as many affected 
products and systems as anybody. Although they may be bringing up the 
rear among the vendors, the rear has clearly been brought up.

In less than one year (10 months since public disclosure), we've taken 
an exceptionally thorny protocol security bug and helped and encouraged 
the great majority of the industry to quickly deploy a fix.

To put this in perspective, I'll be talking on Thurs (Usenix Security 
10) about another protocol (NTLM/MSCHAP v1,2) which has been subject to 
a known credentials forwarding attack for about the last 16 years 
without a proper fix! Alice connects to wifi in coffeehouse, Bob gets 
into VPN. It's that bad.

This list was especially active back in Nov-Dec when the public 
discussion began. Lots of us put in extra effort discussing every detail 
to death making sure the IETF-endorsed solution would close the security 
hole, preserve the needed functionality, and cause minimal disruption 
during deployment. The only work remaining in this mitigation is to not 
let everyone forget to eventually migrate to strict rather than 
compatible mode.

There was more than one person (mostly not on this list) who said it 
couldn't be done, yet it was. Certainly there there will be systems 
which do not deploy the fix, but such unmaintained systems become less 
relevant over time and are probably vulnerable through many other 
vectors already.

I think everyone on this list deserves a pat on the back (I would buy 
the next round if I could :-).

- Marsh