Re: [TLS] Verify data in the RI extension?

[<[e-mail]>]

Stefan Santesson wrote:

> To me it seems obvious that the best security design is to NOT
> exchange this data if the objective is to verify that the parties
> already hold the data.
> 
> It's feels like "I want proof that you hold this value, so I'm going
> to send it to you".

<not wearing AD hat>

In many cases (such as cipher suites with NULL encryption, or some
apps that use channel bindings) the verify_data values are already
public. So the objective is *NOT* to prove that "I know this value";
the objective is to verify that both ends have the same value.

<wearing AD hat>

About the obviousness of the best security design, it's safe to say 
that when it comes to design style and preferences, people often 
disagree. I think we're reaching "good enough" here -- if people have 
serious concerns that the latest draft does not work, those are
important, but as AD, I'm not going to give much weight to "it could
be nicer" type of arguments in a situation where timely publication 
is important. 

Best regards,
Pasi