Re: [TLS] assert TLSext in renego-ServerHello instead of disable renego

[David-Sarah Hopwood <[e-mail]>]

Michael D'Errico wrote:
>>> The problem is that your initial handshake *is* the renegotiation!
>>> (from the server's point of view)
>>
>> I may well be confused, but: a handshake is a renegotiation
>> if-and-only-if it is encrypted. Initial handshakes are in the clear.
>> So there is no ambiguity, from either party's point of view, about
>> whether a handshake is a renegotiation.
> 
> Your initial handshake is in the clear from you to the MITM, but it gets
> sent over the already-secure connection from the MITM to the server, so
> from the server's perspective you are renegotiating.  This is why you
> have to send the Renegotiation_Info extension -- it let's the server
> know that *you* think you are performing an initial handshake.  It can
> then shut down the connection and save you from the attack.

If from the server's perspective you are renegotiating, and it doesn't see
a non-empty and correct Renegotiation_Info, then it should shut down the
connection anyway. The server doesn't need to know whether the client
supports the extension; to avoid the attack, it has to shut down the
connection whether the client supports the extension or not.

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com