Re: [TLS] draft-rescorla-tls-renegotiate and MITM resistance

[Yair Elharrar <Yair.Elharrar at audiocodes.com>]

David-Sarah Hopwood wrote:
>Marsh Ray wrote:
>> Yair Elharrar wrote:
>>> In addition, until such time that all clients in the world start
>>> supporting this extension (e.g. kiosks in airports), servers will
>>> have to support backward compatibility.
>>
>> It will be a trade-off for each server admin to weigh and decide their
>> policy. I suspect many admins will prefer not to allow insecure
>> connections from unpatched airport kiosks.
>
> To prevent this attack, they don't have to disallow connections, only
> renegotiations in which the extension is not used.
>

That's a very good point. Perhaps the draft could be changed to reflect that?
I can't see any reason why an airport kiosk would need to renegotiate an HTTPS connection (these devices rarely have client certificates installed); however it should be allowed to connect to secure web sites.

           Yair

--

This email and any files transmitted with it are confidential material. They are intended solely for the use of the designated individual or entity to whom they are addressed. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, use, distribution or copying of this communication is strictly prohibited and may be unlawful.

If you have received this email in error please immediately notify the sender and delete or destroy any copy of this message