[TLS] Could the renegotiation attack be used for session hijacking?

[Yoav Nir <ynir at checkpoint.com>]

Hi.

One of our security experts came up with an extension to the  
renegotiation attack, that may lead to session hijacking. It's  
probably not relevant for HTTPS, because those connections are short- 
lived, but may be relevant for applications with longer-lived sessions  
that require rekeying. draft-rescorla-tls-renegotiation should solve  
this as well:

1. Client connects without a certificate, but the session is  
authenticated by the protocol (like an HTTP form or FTP login). The  
MITM just proxies the connection to allow the client to authenticate.

2. After a while, the session requires rekeying, so the server sends a  
HelloRequest.

3. The MITM stops passing data to the client, and sends a ClientHello  
to the server.

4. The server and MITM complete the handshake, and the MITM has  
effectively hijacked the session from the client. The persistent  
application session means that the MITM is now authenticated to the  
server as the client.

Seems to me that this will work, right?  Am I missing something?

Yoav

Attachment: smime.p7s
Description: S/MIME cryptographic signature