Re: [TLS] draft-rescorla-tls-renegotiate and MITM resistance

[Yoav Nir <ynir at checkpoint.com>]

David-Sarah Hopwood wrote:

> Marsh Ray wrote:
>> Yair Elharrar wrote:
>>> In addition, until such time that all clients in the world start
>>> supporting this extension (e.g. kiosks in airports), servers will
>>> have to support backward compatibility.
>>
>> It will be a trade-off for each server admin to weigh and decide their
>> policy. I suspect many admins will prefer not to allow insecure
>> connections from unpatched airport kiosks.
>
> To prevent this attack, they don't have to disallow connections, only
> renegotiations in which the extension is not used.

Even that can be further refined. You can freely renegotiate an authenticated session, as long as the renegotiation does not involve an identity change.

Obviously, if the first handshake include client authentication, any renegotiation that includes the same client cert is fine.

If the session is authenticated by the application (as in an HTTPS login page) it's also possible to renegotiate with impunity, but the interaction here between the application and the TLS layer may be too sensitive an bug prone to specify in the draft. For example, if an SSTP server renegotiates after the client has authenticated (through PPP), I don't think there's a security risk in not implementing the extension.