Re: [TLS] simplistic renego protection

[Marsh Ray <marsh at extendedsubset.com>]

David-Sarah Hopwood wrote:
>
> If lenient servers are allowed, then I think it will take *much* longer
> until the vulnerability is eliminated from most connections.

If lenient servers are not allowed, a server admin cannot patch his
server until all clients have patched. The world will have long given up
on renegotiation by then and just patched to disable it entirely.

If lenient servers are allowed, the servers can patch right away and
immediately begin protecting connections made with patched clients.

This group has to quit thinking it can dictate limits on functionality
in order to compel the consumers of the technology to do things your
way. The world isn't exactly leaping at the chance to upgrade to each
new TLS RFC you know. Trying to do that on a security fix is going to
leave a particularly bad taste in people's mouths.

- Marsh