From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-0.1 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU autolearn=ham autolearn_force=no version=3.4.4 Received: (qmail 25905 invoked from network); 23 Jan 2023 11:19:52 -0000 Received: from 9front.inri.net (168.235.81.73) by inbox.vuxu.org with ESMTPUTF8; 23 Jan 2023 11:19:52 -0000 Received: from sendmail.purelymail.com ([34.202.193.197]) by 9front; Mon Jan 23 06:18:27 -0500 2023 DKIM-Signature: a=rsa-sha256; b=R0atSD44XeXs4QXO9UgOtCI7p+OerEIYafZGsi9g4Q2RuNlQgJthYSOMBGCnRiak1ppbOhwuMPyEtlTnhJiLCOb5FhK0hZwHbJ05lmX6389EN5tbyw4++9izX5eZGcpkLOALtjpSC54HXsp8Epvf1NHoY51/hEhx79F0D46sNrIA9GH3xG5vCxnfuCT3LfbxBFPptpcai1MuK89uFfXpJdzNB9bSeREYYM39pkhqpcG6TGVnqXU2gIUymyEIKMC9O0e4UzLVkNowRW6Zc3CsyafpDjDqBOuIqSmBXiHtr//zdioJUCQznyuLZ9bO2FLxQ9p/KjpXu1RnYZVxMrM0aw==; s=purelymail1; d=pbrane.org; v=1; bh=lNjjiB2LV0m5qQjDdLLHn/2Ot5/B3fBc4EEqXTP+Z14=; h=Received:From:To:Subject; DKIM-Signature: a=rsa-sha256; b=ARB8LrMV+cRYrgMXe/DQcABJdUSAnvb8krRDEwYMBbMIpY9fnN9M7+m/xXJaTIMH146tIr5IicGPMV342IXe626mNXQQTD0535dEFXZxbQI83iggbDRBn27t6YC3yEtPtROnw9hxbRbRVrlrMw/iZ4bKenMFJnVpl82yszdJU6PWx4lSAtZYcaiMgIsYV5FYcxgU70FfHyGC/svhmq42W65epw8csyMNT94uTsvN856J4bpuRKEYeWnNNApnvHmWkYM1I88k/Ed7NULa2pcVmleNmMcJ4ii86ER3UWawhU/1kmXgOiI/W72h4A/ezSTzwmPJ2qbmrVe760KwxQpgsA==; s=purelymail1; d=purelymail.com; v=1; bh=lNjjiB2LV0m5qQjDdLLHn/2Ot5/B3fBc4EEqXTP+Z14=; h=Feedback-ID:Received:From:To:Subject; Feedback-ID: 10987:2443:null:purelymail X-Pm-Original-To: 9front@9front.org Received: by smtp.purelymail.com (Purelymail SMTP) with ESMTPSA id -1549512869 for <9front@9front.org> (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Mon, 23 Jan 2023 11:18:14 +0000 (UTC) Date: Mon, 23 Jan 2023 03:18:03 -0800 From: Anthony Martin To: 9front@9front.org Message-ID: References: <87988F72F1C2D20B16DE8DA47FB8C262@alice> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable In-Reply-To: X-MIME-Autoconverted: from 8bit to quoted-printable by Purelymail List-ID: <9front.9front.org> List-Help: X-Glyph: ➈ X-Bullshit: singleton element TOR template-based proxy NoSQL element database Subject: Re: [9front] [PATCH] libsec: add minimal support for the tls renegotiation extension Reply-To: 9front@9front.org Precedence: bulk hiro <23hiro@gmail.com> once said: > your explanation of their secondary reasoning is good. the original > assumptions that led to this extension are still invalid. The IETF TLS group had a lengthy discussion=C2=B9 about this problem back in 2009 when Marsh Ray described his attacks=C2=B2. Martin Rex said: =09I can understand what it says, but I _really_ dislike it. =09The root of the problem is servers that perform (or at least =09allow) TLS renegotiations and make flawed assumptions about =09what a successful TLS renegotiation means for the data =09previously received. =09What you're essentially asking for, is that a client should no =09longer talk TLS to _any_ Server that doesn't support the new =09extension. Not even to the good ones that neither offer nor =09support renegotiation. =09This is discriminating against servers that have been playing =09safe! =09Essentially we are going to hold TLS clients and the installed =09base of good Servers responsible for the broken Servers out =09there. That feels very wrong. Eric Rescorla responded: =09I'm not recommending that clients do that. What I'm trying to =09say is that *if* a client wants to be totally sure then all it =09can do is require the extension. I agree it's impractical (and =09probably unwise) to suggest that they actually behave that =09way. The OpenSSL developers have decided that clients should now "do that" by default. Like it or not, OpenSSL is the apex predator. We can either refuse to support v3.0 clients connecting to our servers or make the minimal changes necessary to accommodate them. I think we all know our place in the ecosystem. I'm not defending their decision. I just fixed the problem months ago and moved on with my life. I was checking in to see if you guys still wanted the patch or not. Cheers, Anthony 1. https://mailarchive.ietf.org/arch/msg/tls/N7EcRpvK2ENs5IwWYv2p7nrUG8w/ 2. https://web.archive.org/web/20091107111709/http://www.extendedsubset.com= /