Re: [TLS] Need for S->C signaling

[Nasko Oskov <noskov at microsoft.com>]

Stefan Santesson wrote:
>Just a question to make sure we have accurately exhausted this aspect.
>
>Is it really necessary for the Server to signal that is is patched other than 
>using a modified finished calculation if it is patched/upgraded.

Yes. If you use the finished message, the attack is still possible.

>One scenario could be:
>
>1) Client use the magic cipher suite to signal that it is patched/upgraded.
>2) Client sends a normal finished message.
>3a) Un-patched server replies with normal finished message.
>3b) Patched server replies with upgraded finished message.
>
>This way the client could determine whether the server is patched or not
>and act accordingly and get the security context of renegotiate from the
>patched server.

Once the server replies with the Finished message, it would move to
connected state and the HTTP stack is clear to execute the MiTM request. As
part of developing proof of concept for our own testing, I've observed that
connecting to IIS server will send the server CCS, Finished, App data.
Even if the client were to drop the connection, the request has been
executed and attack is carried out.

>There are probably reasons why this is not a good idea. I'm just not really
>sure what they are.