Re: [TLS] Simple way to drop re-negotiation in HTTP (Re: draft-rescorla-tls-renegotiate.txt)

[Nicolas Williams <Nicolas.Williams at sun.com>]

On Sat, Nov 07, 2009 at 12:00:29AM -0600, Marsh Ray wrote:
> Nicolas Williams wrote:
> > The simplest way to drop re-negotiation in web servers is this (based on
> > an idea by Nelson Bolyard):
> 
> Wow that does make it sound easy. All we need to do for HTTPS is get a
> new port number assigned and the entire burden of the solution passes
> from the TLS specs to server implementors and site admins?

[Complaints that new port numbers for this are not really feasible
elided.]

For services inside a firewall this would be simple enough.  For all
others one may split the public vs. for-authenticated-users services
across multiple IP addresses rather than port numbers; this is [much?]
harder to automate.

But you convince me that this is not realistic.  To properly automate
this would require... software updates, which is pretty much what we
need to fix the bug in the first place; if this workaround is not
automated, then it won't be deployed.  Must likely, as you say, the
world will sit in the vulnerable state for a long time.  Very
unfortunate, that.

Nico
--