Given a specific SSL/TLS connection, I would like to know what is the proper way to launch a parameter renegotiation, asked from client side.
1) Are they any requirements from the previous handshake in the parameters established?
2) What is the exact structure of the first message sent by the client asking for the renegotiation?
3) What are the next messages exchanged then by the server and the client. If they are different from an usual handshake, in what way?
Thank you in advance for your answers
Additional questions after Thomas Pornin answer :
A. Regarding the RFC 5746
I now understand a bit better how it works, however I still don't catch why renegotiating parameters are an issue when a MITM launches it, according to your link rfc5746#section-1. What interests has a MITM to ask for a renegotiation, since he won't know by any way the secrets exchanged, (in particular the pre-master secret [PMS] sent during the ClientKeyExchanged).
Once the renegotiation is done, the MITM has no way to decrypt the incoming messages sent from the client/server.
I see only 2 possibilities during the renegotiation for exchanging the PMS :
- either the MITM provides his certificate to the client, so that the client encrypt the PMS with the MITM certificate. In that case, the client easily detects it, since it's not the certificate he is waiting for ;
- either the MITM forwards the server certificate, but in that case the MITM won't have any way to decrypt it, and decrypt the following exchanged messages, since he won't have recovered the PMS.
So where is the security issue allowing some renegotiation by the protocol ?
B. Regarding the structure
You underlined that there was no defined and precise structure given by the RFC. How did OpenSSL team figured this out then? What structure did they choose?