Re: [TLS] assert TLSext in renego-ServerHello instead of disable renego

[Bodo Moeller <[e-mail]>]

On Nov 15, 2009, at 12:22 PM, Marsh Ray wrote:
> Bodo Moeller wrote:
>>
>> Arguably I'd rather have monitoring tell me about clients that will
>> *tolerate* a handshake with a server that doesn't support the  
>> extension
>> (not so much about clients that don't support the extension at  
>> all).  In
>> that case, I wouldn't want these clients to send the extension on the
>> initial handshake.
>
> Good point.
>
> These systems will probably spot unsafe renegotiations happening.

How would they do that?  Everything is supposed to be encrypted then.


> It may be that we need two bits: 'endpoint patched' and 'endpoint
> configured secure'.

I don't think the protocol should too much be designed around making  
monitoring systems happy.  You can't do this for all interesting  
issues that client or server implementations might have anyway.  Here  
we have a vulnerability that's easy to fix in such a way that  
monitoring systems can see some fix deployment information, so why  
not.  Adding extra flags just for monitoring's sake, I'm not so sure.

Bodo