Re: [TLS] Another critical problem with RI

[Martin Rex <mrex at sap.com>]

Michael D'Errico wrote:
> 
> Michael D'Errico wrote:
> > Here is yet another reason to reject Renegotiation_Info:
>
> It looks like I got scooped by Martin by 4 minutes!  :-)

I'm sorry.  

It seems that you thought about what it would mean to implement
my newest idea (tunneling verify_data into the handshake message hash
through Hello.Random, somewhat similar to what TLS extension RI does)
and realized this problem.

I had just started to change my I-D that I'm working on and
describe the new idea when I stumbled over this problem.


It was somewhat similar when I was trying to explain to Nico
and Larry that they can not simply ignore that channel bindings
don't carry over through TLS renegotiation, when I realized that
TLS renegotiation would therefore be susceptible to MitM attacks.


-Martin