Re: [TLS] Last Call: <draft-ietf-tls-downgrade-scsv-03.txt> (TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks) to Proposed Standard

[Michael Clark <[e-mail]>]

On 23/1/15 10:33 am, Michael Clark wrote:
> --- a/draft-ietf-tls-tls13.md
> +++ b/draft-ietf-tls-tls13.md
> @@ -2674,7 +2674,7 @@ Structure of this message:
>  
>  
>  verify_data
> -:      PRF(hs_master_secret, finished_label, Hash(handshake_messages))
> +:      PRF(hs_master_secret, finished_label, Hash(handshake_records))
>               [0..verify_data_length-1];
>  
>  finished_label
> @@ -2691,7 +2691,7 @@ Finished computation.
>  > In previous versions of TLS, the verify_data was always 12 octets long. In
>  the current version of TLS, it depends on the cipher suite. Any cipher suite
>  which does not explicitly specify verify_data_length has a verify_data_length
> -equal to 12. This includes all existing cipher suites. Note that this
> +equal to 16. This includes all existing cipher suites. Note that this
>  representation has the same encoding as with previous versions. Future cipher
>  suites MAY specify other lengths but such length MUST be at least 12 bytes.

Extending verify_data obviously pushes on he lower bound of the
protection bits offered by the lowest asymmetric encryption or
pre-shared key size allowed in TLSv1.3 so that should probably be advised.

I'll leave it up to the experts to decide whether my patch is appropriate.

I made a mistake and missed a second occurrence of 12. Here is a re-spin
of the Hash verify_data patch.

--- a/draft-ietf-tls-tls13.md
+++ b/draft-ietf-tls-tls13.md
@@ -2674,7 +2674,7 @@ Structure of this message:
 
 
 verify_data
-:      PRF(hs_master_secret, finished_label, Hash(handshake_messages))
+:      PRF(hs_master_secret, finished_label, Hash(handshake_records))
              [0..verify_data_length-1];
 
 finished_label
@@ -2691,9 +2691,9 @@ Finished computation.
 > In previous versions of TLS, the verify_data was always 12 octets long. In
 the current version of TLS, it depends on the cipher suite. Any cipher suite
 which does not explicitly specify verify_data_length has a verify_data_length
-equal to 12. This includes all existing cipher suites. Note that this
+equal to 16. This includes all existing cipher suites. Note that this
 representation has the same encoding as with previous versions. Future cipher
-suites MAY specify other lengths but such length MUST be at least 12 bytes.
+suites MAY specify other lengths but such length MUST be at least 16 bytes.
 
 handshake_messages