Re: [TLS] Verify data in the RI extension?

[Eric Rescorla <[e-mail]>]

At Fri, 27 Nov 2009 16:27:03 +0100 (MET),
Martin Rex wrote:
> 
> Eric Rescorla wrote:
> > 
> > I also share David Hopwood's concern about ambiguity in the handshake
> > hashes stream created by having data which is not properly formatted
> > injected into the hash
> > (http://www.ietf.org/mail-archive/web/tls/current/msg04857.html),
> > so I don't think the particular approach in Martin's draft is
> > really satisfactory.
> 
> That problem can be trivially fixed.
> 
> We just memorize the non-encrypted Client.Finished and Server.Finished
> handshake messages in full, rather then just the contained verify_data.

Woah, that's scary....

We're going to take the exact messages that previously appeared on the
wire and inject them into the handshake hashes in order to *reduce*
ambiguity in the hash input stream? I mean, maybe that's OK, but it
sure isn't obviously OK.

-Ekr