Re: [TLS] simplistic renego protection

[David-Sarah Hopwood <[e-mail]>]

Robert Dugal wrote:
> I noticed you said this in the jabber log http://www.ietf.org/jabber/logs/tls/2009-11-12.txt 
> 
> [06:31:06] <EKR> It occurred to me the other day that there is a special case where hte server does not need to refuse renegotiation: when the client has sent no data yet.

and the session is not resumed, and the server has sent no data.

Many application protocols have the client sending a command or
"hello" message before the server sends any data, but some don't,
and TLS doesn't depend on that. If the server thinks it has already
sent some data, then it may not send it again in the renegotiated
session, which could confuse the client in that session.

> [06:31:20] <EKR> This would allow step-up/SGC to continue to work 9assuming we cared it)
> 
> Our products do support step-up/SGC and some customers may still be using it, or at least have servers with SGC certificates.
> Since there is no vulnerability is this special case, should some note be added to the draft? 

SGC is not relevant here; it does not use renegotiation.

AFAIK, the only clients that use Step-Up are international versions of
Netscape Communicator 4.02 to 4.72 inclusive [*], and possibly some
very early versions of Mozilla Suite before its official release.
Netscape 4.72 was released in February 2000. Those browsers are completely
insecure and no-one should still be using them, least of all if they
actually need 128-bit encryption.

The fact that a server uses a Step-Up certificate does not cause any
interoperability problem for other clients.


[*] <http://www.verisign.com/static/016585.pdf>

Technical documentation of Step-Up:
<http://marc.info/?l=apache-modssl&m=102520283911746&w=2>

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com