Re: [TLS] Proposal for hybrid solution using most of the ideas

[David-Sarah Hopwood <david-sarah at jacaranda.org>]

Nasko Oskov wrote:
> Currently, many browsers attempt to negotiate TLS with extensions, but if it fails
> for any reason, they re-start the negotiation without extensions (either as a TLS
> negotiation or an SSLv2/3) negotiation. That behavior leads to a trivial downgrade
> attack by a MiTM - all the MiTM has to do is fail any negotiation with the
> renegotiation extension present and wait for the browser to try a negotiation
> without it. This leads to situation where the client is unaware if there is MiTM
> or real server that doesn't support extensions. If we want browsers to be secure
> we have no choice but fixing SSLv3 somehow or disabling it entirely.

In the RI proposal, if the client doesn't fall back on a renegotiating
handshake, then there is no downgrade attack.

Falling back to SSLv3 on a renegotiating handshake is not necessary,
because the server needs to be patched in order for a renegotiating
handshake to succeed. If it is patched, then it is TLS- and
extension-tolerant.

We *want* renegotiating handshakes with unpatched servers to fail. That is
not an interoperability bug; it's a security feature.

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com

Attachment: signature.asc
Description: OpenPGP digital signature