Re: [TLS] simplistic renego protection

[Martin Rex <[e-mail]>]

Eric Rescorla wrote:
> 
> I don't agree with your analysis of code complexity, but even if
> you were correct the implementation effort is in any case so
> minimal compared to the size of the deployment problem
> that it strikes me as largely irrelevant. Moreover, we already
> have implementations of RI, so the marginal implementation
> effort is even lower compared to doing something new.

There is obviously no surprise that those who have already implemented
this proposal in secret have a bias towards using it.  Most of them
are actually affected by the problem, because they offered TLS
renegotiation on the server side.


Please consider that you are asking a lot of other implementors,
who do not have an implementation yet, and many of which are not
actually vulnerable to the problem, to implement this.
For them, the difference between a TLS extension RI and a much
smaller and more efficient extension-less solution can be
very significant -- in particular when it comes to testing
the server-side of the generic extensions handling.


The amount of code changes for the extension-less solution is
rather small, this is _NOT_ going to be a burden for the
implementors that have experimenting with TLS extension RI.
It will be LESS than a day of work for each codeline.

Offering UIs or APIs to configure policy is more than 10x
the effort than implementing the actual protocol fix
(which, as I said, is basically the same as the TLS extension RI,
just without the superfluous TLS extension wrapping).
And that policy configuration stuff will work equally well
for both.


-Martin