Re: [TLS] Quest for Unified Solution to TLS Renegotiation

[Martin Rex <[e-mail]>]

Eric Rescorla wrote:
> 
> At Wed, 25 Nov 2009 13:03:16 -0800,
> Michael D'Errico wrote:
> > 
> > I think that it would be good to find a unified solution that
> > everybody is happy with, and believe that this may be it:
> 
> This was actually suggested by Bodo Moeller last week.

It's one of the options I summarized two weeks ago:

http://www.ietf.org/mail-archive/web/tls/current/msg04115.html


> 
> >    3) Incorporate previous verify_data into Finished calc.
> 
> I'm not happy with this, actually.
> 
> This requires breaking the current clean definition of handshake
> hashes as the hash of all the handshake messages and simply adding
> some synthetic message in the middle. I don't think this is anywhere
> near as clean, as evidenced by the ongoing debate about whether to put
> it the synthetic data in the front, the back, incorporate it into the
> PRF, or chain the pre-existing handshake messages. [FWIW, I think I
> prefer the last of these implicit versions.]


I *really* prefer this.  It's perfectly clean, and when doing it
right after ServerHello, it ends up at the same position
as if it was sent by the server in ServerHello.

> 
> By contrast, RI allows that part of the system (which is well
> understood)

That change is certainly _not_ going to break anything
and well within the "well understood" domain.

I explained it here:
http://www.ietf.org/mail-archive/web/tls/current/msg04194.html


-Martin