Re: [TLS] History of extensions

[Nicolas Williams <[e-mail]>]

On Sat, Nov 14, 2009 at 01:08:16AM +0200, Eric Rescorla wrote:
> At Fri, 13 Nov 2009 10:46:09 -0600,
> Nicolas Williams wrote:
> > The post with message-ID <[e-mail]>, subject
> > "Comments on draft-rescorla-tls-renegotiate", sent at 18:54:19 -0600
> > yesterday most certainly described no Hello extensions, only a Finished
> > message verify_data computation change.
> 
> Yes, and it doesn't allow you to probe in a compatible way.

No, that's not correct.  On initial connection there's no need to do
anything special (sure, it's nice to know that your peer doesn't have
this vuln, but you don't have to).  On re-negotiate you unconditionally
want non-vulnerable behavior, thus there's nothing to negotiate, nothing
to probe for.

It's only when you're willing to re-negotiate in a vulnerable way that you
should probe/negotiate.  That may be useful as part of a transition
strategy.  However, if the negotiation itself causes breakage, then it
may not be feasible.

I repeat: "[this proposal is to] be ingored if the use of protocol
extensions in draft-rescorla-tls-renegotiate is deemed to not be a
problem".

Nico
--