Re: [TLS] Comments on draft-rescorla-tls-renegotiate, and a new proposal

[Nelson B Bolyard <[e-mail]>]

On 2009-11-13 21:30 PDT, David-Sarah Hopwood wrote:

> [*] There is a corner case in which this argument might not apply --
>     the "Step-Up" protocol, where old versions of the Netscape browser
>     would initially offer only 40-bit ciphersuites, and then renegotiate
>     to use a stronger ciphersuite if they see that a bit is set in the
>     certificate. Such browsers are obviously unpatched, and will fail to
>     renegotiate with a patched server that is using a Step-Up certificate.
> 
>     Note that "Step-Up" is different from "Server-Gated Cryptography"
>     (SGC), in which the client never completes the first handshake and
>     reconnects in a new session: SGC does not rely on renegotiation.
>     (Verisign/Thawte sells certs that support both and does not
>     distinguish between them; don't be confused by that.)
> 
>     Step-Up was a Netscape proposal, and SGC was from Microsoft.
>     I don't think that Internet Explorer ever implemented Step-Up (as
>     opposed to SGC). 

I believe that's correct, and likewise, Netscape never implemented SGC.

> Netscape only implemented it in versions 3.x and 4.x, which have numerous
> arbitrary code execution bugs that would be easier to exploit.

I would add that Mozilla browsers use TLS code inherited from Netscape.
All the Netscape and Mozilla export browsers implemented Step-Up until
the U.S. export regulations changed in the year 2000.

> So this is not a significant issue at all -- any sites that are still
> using Step-Up certs, would be well advised to just patch their servers
> and tell their users to stop using such old browser versions.

I agree, emphatically.  But I have been told that there are still CA
selling step-up certs to this day, because there are still server admins
buying them, because there are still users in the world using those old
clients.  Given the premium prices historically obtained for Step-Up
certs, I'm not optimistic that CAs will voluntarily cut off sales of
their highest margin products for the good of a few users whose systems
are hopelessly vulnerable anyway.

/Nelson Bolyard
Developer of TLS code used in Mozilla and (formerly) Netscape clients