[TLS] Redefine Finished message for TLS 1.3 ?

[Nelson B Bolyard <[e-mail]>]

On 2009-11-13 08:46 PDT, Nicolas Williams wrote:
> On Fri, Nov 13, 2009 at 10:22:35AM +0200, Eric Rescorla wrote:
>> At Thu, 12 Nov 2009 14:38:47 -0600, > Nicolas Williams wrote:
>>> Interestingly, that approach could even be used on initial
>>> connections to detect if the server will support secure
>>> re-negotiation _before_ the client ever tries it.
>>
>> I don't see that. AFAICT both your options involve the client
>> generating a hello extension, so this does affect the bits on the wire.
>> Obviously there are approaches which don't require that, but they don't
>> provide detection of server capabilities on initial negotiation. By
>> contrast your message of 1854 doesn't allow the client to probe the
>> server AFAICT.
> 
> The post with message-ID <[e-mail]>, subject
> "Comments on draft-rescorla-tls-renegotiate", sent at 18:54:19 -0600
> yesterday most certainly described no Hello extensions, only a Finished 
> message verify_data computation change.

EKR and Marsh Ray and some others will recall that I proposed essentially
the same proposal that Nico is now proposing in the meeting meeting in
Mountain View on September 29, 2009 to which Marsh Ray invited EKR, myself
and numerous others from this working group.

I proposed that a change in the computation of the TLS Finished message
to include some value derived from the master secret previously in use on
the connection before the current renegotiation (such as the Finished
message contents or some other value "extracted" from the master secret)
would avoid the overhead of the new extensions on the wire.  My goal was
to avoid the extra bandwidth and memory cost of those extensions, which
might be deemed too costly in certain low memory or bandwidth constrained
applications.

Others in the meeting responded that changing the definition of the
computation of the Finished messages was a change to the base protocol
specification (which adding an extension is not), and thus the change
I proposed would make TLS become (say) TLS 1.3.

The proposed new extension could be implemented as a patch to an extant
implementation of TLS 1.0, but an implementation of TLS 1.3 would presumably
require the implementation of all the changes in TLS 1.1 and
1.2 first, which would be a much bigger and slower undertaking for many
TLS implementations.

So, for the sake of hasty implementation, we abandoned the approach that
redefines the Finished message and went with the new extension.

But perhaps we should regard the new extension as a short term expedient,
and plan to change the definition of the Finished message in TLS 1.3,
so that the extension will no longer be necessary at some point in the
future (when TLS 1.3 has become common place, maybe 10 years hence).

Does the Working Group share interest in redefining the Finished message
computation for TLS 1.3?