Re: [TLS] CCS and key reset and renegotiation

[Nico Williams <[e-mail]>]

On Thu, Jun 5, 2014 at 10:09 AM, Salz, Rich <[e-mail]> wrote:
> I think it adds weight to my concern about using ChangeCipherSpec to do key
> reset.  I still prefer the trade-offs of having a “slow the TLS but keep the
> TCP layer open” and starting over.  Much simpler to prove it’s correct.

The good news is these bugs are getting found, and that this and
Heartbleed aren't protocol bugs -- sure, the protocol made it easier
for programmers without automatic bounds checking and so on to screw
up, but, the problem is the lack of bounds checking and so on.  And,
frankly, this bug is just the result of failure to keep one bit of
state: if there's no key, then CCS should cause a protocol failure --
the sort of bug that the protocol can't be blamed for, like the goto
fail bug.  I know the discoverer thinks that the description of CCS is
to blame, but I don't.  I think it's just this one bit of state, not
kept or not checked where it matters.

The bad news is that there's no plan to replace OpenSSL with something
better; there is nothing better with sufficiently friendly licensing
terms.  What other serious bugs lurk unknown to the public?  There's
no light yet at the end of this tunnel.

Nico
--