TLS renegotiation MITM

[Steve Dispensa]

Hi,

A colleague and I have released details of a new attack against TLS in the
area of renegotiation. Information is here:

http://extendedsubset.com/?p=8

During the process of running this bug (and its proposed solution) to
ground, I implemented a patch to GNUTLS, attached. There are also two new
files that implement the extension that solves the problem.

There is lots of background in the above link, but the one missing part is
the Internet Draft that has been tentatively agreed on by most of the major
vendors (pending IETF action, of course). That draft is what I have
implemented, and you should see it posted to the TLS IETF list tomorrow
morning.

I'd be happy to help in any way I can.

Thanks.

 -Steve

ext_safe_renegotiation.c
Description: Binary data

ext_safe_renegotiation.h
Description: Binary data

gnutls-safe-renegotiation.patch
Description: Binary data