Re: [TLS] assert TLSext in renego-ServerHello instead of disable renego

[Eric Rescorla <ekr at networkresonance.com>]

At Tue, 10 Nov 2009 06:33:42 +0000,
David-Sarah Hopwood wrote:
> 
> [1.1  <text/plain; UTF-8 (quoted-printable)>]
> Michael D'Errico wrote:
> >>> The problem is that your initial handshake *is* the renegotiation!
> >>> (from the server's point of view)
> >>
> >> I may well be confused, but: a handshake is a renegotiation
> >> if-and-only-if it is encrypted. Initial handshakes are in the clear.
> >> So there is no ambiguity, from either party's point of view, about
> >> whether a handshake is a renegotiation.
> > 
> > Your initial handshake is in the clear from you to the MITM, but it gets
> > sent over the already-secure connection from the MITM to the server, so
> > from the server's perspective you are renegotiating.  This is why you
> > have to send the Renegotiation_Info extension -- it let's the server
> > know that *you* think you are performing an initial handshake.  It can
> > then shut down the connection and save you from the attack.
> 
> If from the server's perspective you are renegotiating, and it doesn't see
> a non-empty and correct Renegotiation_Info, then it should shut down the
> connection anyway. The server doesn't need to know whether the client
> supports the extension; to avoid the attack, it has to shut down the
> connection whether the client supports the extension or not.

Yes, that's correct.

-Ekr