Re: [TLS] assert TLSext in renego-ServerHello instead of disable renego

[Michael D'Errico <mike-list at pobox.com>]

> Suppose that the client sent an SSLv3 ClientHello
> with client_version = 3.1 (or higher). Assuming the server supports TLS,
> then TLS will be negotiated. So when the client sends the renegotiation,
> it knows that it is safe to send extensions. The attack is prevented as
> long as the renegotiating handshake uses the extension; it is not necessary
> for the initial handshake to have used it.

The problem is that your initial handshake *is* the renegotiation!
(from the server's point of view)

A client needs to send an empty Renegotiation_Info so that the server
can ascertain whether an attack is taking place.  Otherwise it may be
configured to let you "re"negotiate for practical reasons, and you just
bought someone a pizza.

The scary thing is that a truly paranoid client can't connect to any
unpatched server that asks for credentials immediately.

Mike