Re: [TLS] draft-rescorla-tls-renegotiate and MITM resistance

[Marsh Ray <marsh at extendedsubset.com>]

Yair Elharrar wrote:
> David-Sarah Hopwood wrote:
>> To prevent this attack, they don't have to disallow connections,
>> only renegotiations in which the extension is not used.
>> 
> 
> That's a very good point. Perhaps the draft could be changed to
> reflect that? I can't see any reason why an airport kiosk would need
> to renegotiate an HTTPS connection (these devices rarely have client
> certificates installed); however it should be allowed to connect to
> secure web sites.

Here are some reasons to strongly encourage it:

A variation of the attack involves the client seeing the renegotiation
with MITM and the server sees just a single session. I believe but have
not proven that this bug is not uncommon among typical clients. If TLS
allows connections with anonymous servers (and possibly authenticated
clients), then it violates the same identity guarantee implied by the spec.

At some point in the future it will be a good indication that the client
software is poorly-maintained. Some admins will prefer not to exchange
confidential data with such systems.

Absence of the extension will also raise flags on network monitoring
equipment. Consistent usage will make detection more reliable.

Here are some reasons not to encourage it so strongly:

The attack in which the renegotiation is only seen on the client side
usually requires a logic error on the client's part, so it might not be
a concern of the TLS spec.

Somewhere, someone is doing something over TLS that is not vulnerable
because neither side ever will ever allow renegotiation. Unfortuantely,
this can only be determined by direct inspection of the code at both ends.

- Marsh