[TLS] draft-rescorla-tls-renegotiate and MITM resistance

[Yair Elharrar <[e-mail]>]

The proposed draft is intended to resolve an MITM attack scenario, but is the new extension tamper-resistant?

Since the MITM handles all traffic between the real client and real server, it could add a fake extension to the 2nd ClientHello with its original verify_data, and empty the returned extension in the ServerHello.

In addition, until such time that all clients in the world start supporting this extension (e.g. kiosks in airports), servers will have to support backward compatibility. The MITM can downgrade every client by simply removing the extension from the ClientHello.

        Yair


This email and any files transmitted with it are confidential material. They are intended solely for the use of the designated individual or entity to whom they are addressed. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, use, distribution or copying of this communication is strictly prohibited and may be unlawful.

If you have received this email in error please immediately notify the sender and delete or destroy any copy of this message