Re: [TLS] Proposed text for removing renegotiation

[Yoav Nir <[e-mail]>]

On May 28, 2014, at 3:13 AM, Andy Lutomirski <[e-mail]> wrote:

> On 05/27/2014 03:18 PM, Salz, Rich wrote:
>>> This overloads ChangeCipherSpec, which some might find distasteful, but I think that it is consistent with it's current use and purpose.
>> 
>> Yeah, I'm not thrilled but it, although I admit it is consistent.
>> 
>> I would rather see something like Yoav (?) proposed via Jabber at the interim meeting:  a "reset but don't close" message.  Either side sends it, the other side replies, and at this point all state is thrown away and it's just as if the client first connected.  It avoids TCP reconnect, perhaps requires more work (but the EDH key should be cached), but it seems much clearner.
> 
> I suspect that, without a lot of API care, this will reintroduce the
> original renegotiation attack: client sends a prefix, says "reset but
> don't close", and starts forwarding ciphertext from a different client.

Definitely, so we’d need a same or similar indication to prevent abuse. I tend to think that a binary indication of “initial contact” would be enough (as normal clients will always be “initial contact” and a ClientHello with “initial contact” should never appear after StopTLS), but I could be wrong.

Yoav