Re: [TLS] To extend or not to extend

[Eric Rescorla <[e-mail]>]

At Sun, 15 Nov 2009 13:14:31 -0800,
Nelson B Bolyard wrote:
> 
> On 2009-11-15 03:38 PDT, Eric Rescorla wrote:
> 
> > So, thinking further on my earlier message, I think the following 
> > elaboration will work a bit better:
> > 
> > - Strict clients (those which wish to insist on RI) generate RI on
> >   initial handshake. As I said earlier, I don't think this is
> >   useful, but it works.
> > 
> > - Lenient clients do not generate RI on initial handshake but do
> >   generate it on rehandshake with TLS 1.0+ only. 
> >   + Moderately lenient clients can fail if the server does not
> >     do RI.
> >   + Really lenient clients can ignore the server's failure to
> >     do RI.
> 
> Aren't your so-called Lenient clients still 100% vulnerable to the attack?
> 
> What prevents their initial handshakes from being used by an attacker as
> renegotiations with a vulnerable server?

Absolutely nothing. As far as I know, the only way to avoid that is to
refuse to connect to any server that you can't verify is upgraded,
which, at least for the moment, is basically the same as saying you
can't connect with a very substantial fraction of the Internet. It
might well be possible to probe as you suggest in a subsequent
message, but I don't think there's going to be a good way inside
TLS...

-Ekr