Re: [TLS] assert TLSext in renego-ServerHello instead of disable renego

[David-Sarah Hopwood <[e-mail]>]

Martin Rex wrote:
> Maybe a patched Server (one with support for secure renegotiation)
> should ALWAYS assert this extension in a renegotiation TLS handshake
> _with_ the verify_data of both server.finished and client.finished
> in the ServerHello -- including when the client didn't send the
> extension (maybe because the client didn't dare confusing an SSLv3 server).
> 
> If we recommend the Server to no longer perform insecure renegotiation,
> we could instead recommend that the server unconditionally asserts the
> ServerHello extension for the renegotiation handshake.

That's not necessary. Suppose that the client sent an SSLv3 ClientHello
with client_version = 3.1 (or higher). Assuming the server supports TLS,
then TLS will be negotiated. So when the client sends the renegotiation,
it knows that it is safe to send extensions. The attack is prevented as
long as the renegotiating handshake uses the extension; it is not necessary
for the initial handshake to have used it.

However, the draft is not clear enough on that last point. It should
clarify that, while including a zero-length Renegotiation_Info implies
that the extension is supported (by either the client or server), the
converse is not true: lack of a Renegotiation_Info extension on the first
handshake does not imply that the extension isn't supported.

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com