Re: [TLS] simplistic renego protection

[Eric Rescorla <[e-mail]>]

At Tue, 17 Nov 2009 13:09:24 +0000,
Stephen Farrell wrote:
> Having watched the recent list traffic I find the above convincing.
> I'd love to see a -01 of the above containing the changes EKR has
> mentioned already, and then a WGLC on that.

I just submitted an -01 version of the draft. This includes the
following changes:

1. Clarification of the encoding of the extension per the issue
   by Eric Young and Nelson Bolyard.
2. A bunch of discussion of fallback and the downgrade issue.
3. A SHOULD level requirement that implementations which simply
   reject negotiation still provide an empty extension when
   requested by the client, thus signalling that they have
   been updated.
4. A new section 4.3.1 that describes a magic cipher suite
   to be used to prevent downgrade attack on implementations
   which fall back to no extensions on handshake failure.
   
I've left point (4) as an OPEN ISSUE because it wasn't clear to me
what the WG feeling was. My general feeling is that it's not necesary:
SSLv3 servers which upgrade to fix this issue by refusing
renegotiation can easily arrange to simply ignore the extension, at
which point no downgrade attack is possible. Servers which don't do
even this can be presumed to be vulnerable and it doesn't seem that
bad to simply fail in this small number of cases. That said, I don't
have a problem with this feature f the WG wants to since it's not
being used by negotiation but merely as a failsafe, and I thought
it was important to get a concrete proposal for this mechanism
on the table.

-Ekr