Re: [TLS] draft-rescorla-tls-renegotiate and MITM resistance

[Dr Stephen Henson <lists at drh-consultancy.demon.co.uk>]

Yoav Nir wrote:
> 
> On Nov 9, 2009, at 3:45 PM, Marsh Ray wrote:
> 
>> Yair Elharrar wrote:
>>> The proposed draft is intended to resolve an MITM attack scenario,
>>> but is the new extension tamper-resistant?
>>>
>>> Since the MITM handles all traffic between the real client and real
>>> server, it could add a fake extension to the 2nd ClientHello with its
>>> original verify_data, and empty the returned extension in the
>>> ServerHello.
>>
>> A valid concern, which I believe is addressed by the fact that the
>> 'Finished' message in TLS contains a MAC which covers extensions present
>> on the Client and Server Hellos.
>>
>> IIRC, earlier SSLs did not cover extensions with a MAC.
> 
> I think SSLv3 did not allow for client extensions at all, and TLSv1.0
> already covered everything.
> 

I think that SSLv3 did allow additional arbitrary data to be added after a
ClientHello without specifying the format (meaning that technically extensions
could be included) and that this additional data was included in MACs.

However testing has shown that many implementations (including one ancient
version of OpenSSL) didn't handle this properly meaning that including
extensions in SSLv3 can result in handshake failure.

OpenSSL did include extensions in SSLv3 but the resulting failures have meant we
don't do this any more.

Steve.
-- 
Dr Stephen N. Henson.
Core developer of the   OpenSSL project: http://www.openssl.org/
Freelance consultant see: http://www.drh-consultancy.co.uk/
Email: shenson at drh-consultancy.co.uk, PGP key: via homepage.