Re: [TLS] Verify data in the RI extension?

[Michael D'Errico <[e-mail]>]

David-Sarah Hopwood wrote:
> Eric Rescorla wrote:
>> I also share [David-Sarah] Hopwood's concern about ambiguity in the handshake
>> hashes stream created by having data which is not properly formatted
>> injected into the hash
>> (http://www.ietf.org/mail-archive/web/tls/current/msg04857.html),
>> so I don't think the particular approach in Martin's draft is
>> really satisfactory.
> 
> That potential weakness can be avoided by encoding the data to be added
> into the hash as follows:
> 
>    struct {
>        enum { fake_finished(20) } fake_handshake_type;
>        enum { zero(0), (2^24-1) } fake_length;
>        opaque previous_client_verify_data<12..255>;
>        opaque previous_server_verify_data<12..255>;
>    } PreviousVerifyData;

I like the direction this is going, but think that using a length of
zero doesn't quite patch the potential weakness.  So instead of zero,
why not use 0xFFFFFF?  An attack would require that a 16MB Finished
message be ignored.

Mike