Re: [TLS] TLSrenego - possibilities, suggestion for SSLv3

[Martin Rex <[e-mail]>]

Yair Elharrar wrote:
> 
> Martin Rex wrote:
> 
> > So the smallest possible change to a server that could be used
> > to signal to ANY client that it believes to be doing an initial
> > handshake might be to set the most significant octet of the
> > gmt_unix_time to zero in order for a server to signal in an
> > extremely backward compatible fashion to the client that it
> > is performing an initial TLS handshake on a connection.
> 
> It would probably be better if the entire 32-bit gmt_unix_time was
> set to one of two predefined magic values: one indicating an initial
> connection ('INIT'), the other indicating a renegotiation ('RNEG').
>
> A client receiving 'RNEG' on an initial handshake would know the
> session is under attack.
> A client receiving 'INIT' on an initial handshake would know the
> session is safe.

 asctime(gmtime("INIT")) = Sun Dec 21 13:49:08 2008  GMT

 asctime(gmtime("RNEG")) = Fri Oct  4 04:34:15 2013  GMT

In theory, 28 random octets provide sufficient room for
probabilistic collision resistance, unless the server
has a real shortage of randomness or a very poorly implemented
function to produce the Random for the ServerHello.

> Any other value would indicate the server is running an
> insecure implementation.


I really do not like to label these an _insecure_.

Any other value gives the client no clue whether the server
is doing an initial or renegotiation handshake, because
it does not contain this change.


-Martin