Subject: [TLS] I-D Action:draft-mrex-tls-secure-renegotiation-02.txt

From: [email-masked]
Date: Tue, 1 Dec 2009 08:30:01 -0800 (PST)

A New Internet-Draft is available from the on-line Internet-Drafts directories.

	Title           : Transport Layer Security (TLS) Secure Renegotiation
	Author(s)       : M. Rex, S. Santesson
	Filename        : draft-mrex-tls-secure-renegotiation-02.txt
	Pages           : 16
	Date            : 2009-12-01

A protocol design flaw in the TLS renegotiation handshake leaves all
currently implemented protocol version of TLS (SSLv3 to TLSv1.2)
vulnerable to Man-in-the-Middle (MitM) attacks where the attacker can
establish a TLS session with a server, send crafted application data
of his choice to the server and then proxy an unsuspecting client's
TLS handshake into the TLS renegotiation handshake of the server. 
Many applications on top of TLS see the data injected by the attacker
and the data sent by the client as a single data stream and assume
that an authentication during the TLS renegotiation handshake or
contained in the client's application data applies to the entire data
stream received through the TLS-protected communication channel.

This document describes a protocol change for all protocol versions
of TLS plus SSLv3 that will fix this vulnerability for all
communication between updated TLS clients and updated TLS servers.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-mrex-tls-secure-renegotiation-02.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: Martin Rex <[email-masked]>
Date: Tue, 1 Dec 2009 21:05:47 +0100 (MET)

> 	Filename        : draft-mrex-tls-secure-renegotiation-02.txt

I have submitted another update of the draft I've been working on
together with Stefan Santesson.  The S->C signaling now uses
a TLS extension, C->S signaling is still with special cipher suite.

(I have one implementor feedback for a defect in the octet string
 representing the encoded TLS extension in section 4.4.  The length
 field for the Extension vector is missing, so it should be
 a 7-octet string 00 05 MSB LSB 00 01 00 rather than 5-octet).

I have added the following paragraph to the Security Considerations about
the controversally discussed "identity change during renegotiation":

   For some applications the possibility for a change in the remote
   peer's authenticated identity during a TLS renegotiation may be a
   vital requirement.  For other applications it is impossible to cope
   with a change of the remote peer's previously authenticated identity
   during renegotiation.  It is recommended that TLS implementations
   offer to applications the option to either disable renegotiation or
   to abort renegotiations where the remote peer tries to replace a
   previously authenticated certificate with a different one during
   renegotiation.

-Martin

---

From: David-Sarah Hopwood <[email-masked]>
Date: Wed, 02 Dec 2009 00:56:34 +0000

Martin Rex wrote:
> the controversially discussed "identity change during renegotiation":
> 

Looks good to me, but I suggest "recommended" -> "RECOMMENDED".

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com