Re: [TLS] TLS renegotiation issue

[Nagendra Modadugu <ngm+ietf at google.com>]

SSL3 is still in wide use since it is not considered insecure (other than the renegotiation issue).  Is it feasible to explicitly deprecate SSL3?  Or state that renegotiation support for SSL3 is deprecated?

Here is the rationale.  Clients that have both SSL3/TLS1 enabled will send a 'mixed-type' SSL3/TLS1 ClientHello (i.e. Record.version = 3.0, ClientHello.version = 3.1).  Such clients should, strictly speaking, not include TLS extensions, which means that renegotiation should not be allowed by the server regardless of the protocol version negotiated.  Considering that a majority of clients will continue to support both SSL3 and TLS1 for some time (as a practical matter), the new extension will not come into effect unless clients (a) cease sending mixed-type ClientHello messages, or (b) send TLS extensions even when Record.version = 3.0.  

Option (a) leaves open the possibility for down-grade attacks (i.e. a MITM blocks TLS1 connections, allowing clients to reconnect over SSL3 -- I recall that atleast one major browser will attempt to reconnect over SSL3 if a TLS1, or mixed-type handshake fails).  Option (b) requires extension support to be "back-ported" to SSL3.

I suggest that the draft discourage the use of SSL3 entirely.

On Thu, Nov 5, 2009 at 10:16 AM, Eric Rescorla <ekr at rtfm.com> wrote:
> I now have a draft extension up at:
>
> https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.txt
> https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.xml
>
> Comments welcome.
>
> -Ekr
> _______________________________________________
> TLS mailing list
> TLS at ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>