Re: [TLS] Collisions (Re: Consensus Call: FNV vs SHA1)

[Marsh Ray <[e-mail]>]

On 5/11/2010 2:23 PM, Nicolas Williams wrote:
> 
> Some of those devilish details:
> 
>  - Clients MUST NOT cache objects from failed handshakes.

Bad guy may see the impending failure and delay the client's recognition
of it arbitrarily.

>  - Clients MAY cache objects from succesful handshakes, and only when
>    the clients authenticate the server (including validation of the
>    server's cert chain to a TA).

It appears that in a large class of client applications, the client TLS
stack may not even know how to fully verify the certificate until he
returns to the application code. Commonly the TLS stack validates that
the server's cert chains to a TA, but the application code queries for
and checks the CN after-the-fact. The method for checking CN is
protocol-specific.

Does the current proposal give more semantic meaning to the exchange of
Finished messages than was expected by such an application?

>  - In particular there MUST NOT be any caching in cases where the server
>    is authenticated by the use of pre-shared certificates.

Sorry if I missed this earlier, what's special about PSK here?

>     - There must be no chance of caching objects when a user clicks
>       through one of those "give your money to the bad guys?" dialogs.

Haven't seen that one.

- Marsh