<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Resending this hoping for a response from someone who has information on disabling TLS renegotiation from the Client side.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Sashank</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>samullap <<a href="mailto:samullap@cisco.com">samullap@cisco.com</a>><br>
<span style="font-weight:bold">Date: </span>Tuesday, 22 November 2016 at 12:21 PM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a>" <<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a>><br>
<span style="font-weight:bold">Cc: </span>"Ram Mohan R (rmohanr)" <<a href="mailto:rmohanr@cisco.com">rmohanr@cisco.com</a>>, "Anil Kumar (anilkum)" <<a href="mailto:anilkum@cisco.com">anilkum@cisco.com</a>>, "Nikhil Mittal (nimittal)" <<a href="mailto:nimittal@cisco.com">nimittal@cisco.com</a>><br>
<span style="font-weight:bold">Subject: </span>Disabling Client-Initiated TLS renegotiation<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div style="font-family: -webkit-standard;"><font face="Calibri">Hi,</font></div>
<div style="font-family: -webkit-standard;"><font face="Calibri"><br>
</font></div>
<div style="font-family: -webkit-standard;"><font face="Calibri">As part of securing our web interfaces, we wanted to disable client-initiated TLS renegotiation. </font></div>
<div style="font-family: -webkit-standard;"><font face="Calibri"><br>
</font></div>
<div style="font-family: -webkit-standard;"><font face="Calibri">The reasoning for this requirement <span style="color: rgb(51, 51, 51); background-color: rgb(255, 255, 255);">is as follows- </span></font><span style="color: rgb(51, 51, 51);"><font face="Calibri"><i>Generally,
renegotiation of TLS sessions is much more resource-intensive for the server than the client, and should therefore not be performed at will to avoid degrading performance. Disabling client from renegotiating secures the server from undergoing a DoS attack
due to continuous renegotiation requests.</i></font></span></div>
<div style="font-family: -webkit-standard;"><span style="color: rgb(51, 51, 51); font-family: Arial, sans-serif;"><br>
</span></div>
<div style="font-family: -webkit-standard;"><font color="#333333" face="Calibri">I</font><font face="Calibri"><span style="color: rgb(51, 51, 51); background-color: rgb(255, 255, 255);"> see that there is an option </span></font><font face="Calibri" style="font-size: 13px;"><b>SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION</b></font><span style="color: rgb(51, 51, 51); background-color: rgb(255, 255, 255); font-family: Calibri;">,
but that is to secure the renegotiation, not disable it.</span></div>
<div style="font-family: -webkit-standard;"><span style="color: rgb(51, 51, 51); background-color: rgb(255, 255, 255); font-family: Calibri;"><br>
</span></div>
<div style="font-family: -webkit-standard;"><font color="#333333" face="Calibri">I</font><span style="color: rgb(51, 51, 51); font-family: Calibri; background-color: rgb(255, 254, 254);"> wanted to check if there is a patch or flag available to disable any
negotiation initiated from the client side.</span></div>
<div style="font-family: -webkit-standard;"><span style="color: rgb(51, 51, 51); font-family: Calibri; background-color: rgb(255, 254, 254);"><br>
</span></div>
<div style="font-family: -webkit-standard;"><span style="color: rgb(51, 51, 51); font-family: Calibri; background-color: rgb(254, 253, 253);">Thanks and Regards,</span></div>
<div style="font-family: -webkit-standard;"><span style="color: rgb(51, 51, 51); font-family: Calibri; background-color: rgb(253, 252, 252);">Sashank</span></div>
</div>
</div>
</div>
</span>
</body>
</html>