Re: [TLS] TLS renegotiation issue

[Michael D'Errico <mike-list at pobox.com>]

Excerpt from the PDF:

> char *req =
>   "GET /highsecurity/index.html HTTP/1.1\r\n"
>   "Host: example.com\r\n"
>   "Connection: keep-alive\r\n"
>   "\r\n"
>   "GET /evil/doEvil.php?evilStuff=here HTTP/1.1\r\n"
>   "Host: example.com\r\n"
>   "Connection: close\r\n"
>   "X-ignore-what-comes-next: ";

The attack works because the last line is unterminated to effectively
comment out the client's GET request.

A possible counter to this attack is for the client to send two
CRLF's prior to its actual request.  This will separate the evil
request from the actual one containing the Cookie.  RFC 2616
prohibits this, but suggests that HTTP servers ignore extraneous
CRLF's due to buggy HTTP/1.0 clients.  In practice, HTTP servers
I've tested ignore them.

Mike



Marsh Ray wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
> Just out:
>
> http://extendedsubset.com/?p=8
>
>
> Eric Rescorla wrote:
> > I should also mention his colleague from phonefactor, steve dispensa. 
>
> And I should mention that EKR, as well as some others who frequent this
> group, have been invaluable in this process so far.
>
> I should mention it, but I didn't because I've deliberately left out
> names where I didn't have a chance to touch base with the person first.
>
> Anyway, I hope this info proves to be valuable and timely for the
> Hiroshima meeting.
>
> By the way, I'm available if I can help answer questions on this list,
> on the phone, or direct email marsh at extendedsubset.com .
>
> - - Marsh
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (MingW32)
>
> iEYEARECAAYFAkrySUAACgkQWChJ3x422/KR/gCfcoAZMgD4RsXVUtLinCSDYWnk
> 14YAnAmtQWE64+61Z0y5ioh/NM1DoPyz
> =YVva
> -----END PGP SIGNATURE-----