Re: [TLS] assert TLSext in renego-ServerHello instead of disable renego

[Eric Rescorla <ekr at networkresonance.com>]

At Tue, 10 Nov 2009 05:44:29 +0000,
David-Sarah Hopwood wrote:
> 
> [1.1  <text/plain; UTF-8 (quoted-printable)>]
> Michael D'Errico wrote:
> >> Suppose that the client sent an SSLv3 ClientHello
> >> with client_version = 3.1 (or higher). Assuming the server supports TLS,
> >> then TLS will be negotiated. So when the client sends the renegotiation,
> >> it knows that it is safe to send extensions. The attack is prevented as
> >> long as the renegotiating handshake uses the extension; it is not
> >> necessary for the initial handshake to have used it.
> > 
> > The problem is that your initial handshake *is* the renegotiation!
> > (from the server's point of view)
> 
> I may well be confused, but: a handshake is a renegotiation if-and-only-if
> it is encrypted. Initial handshakes are in the clear. So there is no
> ambiguity, from either party's point of view, about whether a handshake
> is a renegotiation.

That's not true if you're under attack. Remember that the attacker is
proxying the client's messages over its own encrypted channel.

-Ekr