Re: [TLS] Protected Renegotiation -- refined proposal

[Yoav Nir <[e-mail]>]

Well, there was a suggestion a while back to use magic values for the gmt_unix_time field. Peter Guttman added an important data point, that some implementations already randomize this field, to avoid revealing their incorrect system clock.

This can definitely be used for S-->C signaling, while C-->S signaling can either use the same field, or a special cipher-suite. (I'm wary of using the gmt_unix_time field because there's only one of them - we can't use it again for the next security bug)

So yes, we can meet Marsh Ray's requirement that the signaling be done without extensions.

On Nov 15, 2009, at 3:45 AM, Martin Rex wrote:

> 
> What we should add to the protocol is the signaling of this protocol
> change Client->Server and Server->Client through the ClientHello
> and ServerHello handshake messages.  The most interoperable signaling
> C->S is a specially assigned ciphersuites ID, we probably do not need
> to discuss that.  I'm open to sugestions for the S->C signaling.
> Since the Server will signal only when he sees the clients signal
> in the ClientHello, you could at that point actually change the
> ServerHello message.  Changing the ServerHello is NOT going to
> break anything here!