Re: [TLS] simplistic renego protection

[David-Sarah Hopwood <[e-mail]>]

Eric Rescorla wrote:
> At Mon, 16 Nov 2009 15:20:00 +0100 (MET),
> Martin Rex wrote:
>> Please consider that you are asking a lot of other implementors,
>> who do not have an implementation yet, and many of which are not
>> actually vulnerable to the problem, to implement this.
> 
> I'm not saying any such thing. If you're not willing to do 
> server side renegotiation I think it's perfectly appropriate
> to make no changes to your implementation.

Note that if a server makes no changes, then strict clients will
refuse to connect to it, even on an initial handshake. So *all*
servers that need to be interoperable with strict clients necessarily
have to be changed. This applies to any possible fix that supports
the strict client policy.

(Attempting to detect whether a server supports renegotiation by
trying to renegotiate, doesn't work, because:
 - an attacker can force a renegotiation failure;
 - the server might only reject unsolicited renegotiations;
 - if the client detects a non-renegotiating server and then
   reconnects, it has no assurance that the server it reconnects
   to is the same one -- consider wildcard certificates for instance.)

>> For them, the difference between a TLS extension RI and a much
>> smaller and more efficient extension-less solution can be
>> very significant -- in particular when it comes to testing
>> the server-side of the generic extensions handling.
>>
>> The amount of code changes for the extension-less solution is
>> rather small, this is _NOT_ going to be a burden for the
>> implementors that have experimenting with TLS extension RI.
>> It will be LESS than a day of work for each codeline.
> 
> Yes, as I said above I consider the entire implementation effort
> issue to be a complete red herring. I was merely observing
> that if one takes it seriously it's not clear that it actually
> cuts in the direction you are arguing.

I agree completely; the implementation effort for approaches
using extensions is not significantly greater than for any other
signalling mechanism. For the subset of implementations that
already support extensions, it is less.

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com