Re: [TLS] TLSrenego - possibilities, suggestion for SSLv3

["Rob P Williams" <[e-mail]>]

Hi,

I have a different suggestion for keeping SSLv3 safe.

The problem for SSLv3 and TLS1~1.2 was created here:

5.6.9 Finished

handshake_messages         All of the data from all handshake messages
                           up to but not including this message.  This
                           is only data visible at the handshake layer
                           and does not include record layer headers.

If ALL handshake messages were used - this problem would not exist.
Implementations have treated 'all' as 'from the current handshake'.
(TLS1.0 cemented this problem).

By changing the way the Finished message is calculated - you can make
SSLv3 safer.

Approach:

    For initial handshakes - keep the calculation the same.

    For subsequent handshakes - 
        append extra information to 'handshake_messages' before being
hashed.
        This could be as simple as a counter. 
        This could be the finished data from the previous handshake.

	I've attempted to draw a table of what would happen when
renegotiating;

	OC = old client
	NC = new client
	OS = old server
	NS = new server


            OS   | NS
           ------+-----
      OC  |  .   | fail
      NC  | fail | good


OC-NS failure - is useful - 
    it shows the attack being mitigated.
NC-OS failure - is ALSO useful.
    By attempting to renegotiate - you can verify if you are talking to
an OS or NS.


--
rob | Software Developer
Certicom Corp. | A susbidiary of Research In Motion Limited

main | [phone]
direct | [phone]

[e-mail]
www.certicom.com




---------------------------------------------------------------------
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.