Re: [TLS] Verify data in the RI extension?

[Stefan Santesson <[e-mail]>]

Pasi,

On 09-11-27 3:09 PM, "[e-mail]" <[e-mail]> wrote:

> For simplicity, the current draft is already very simple, and IMHO
> it's not clear that continuing to tweak it has a positive return
> on investment, considering it delays the publication.

It's not a matter of tweaking,

This working group discussion has produced 2 proposals.

If you count in changes that is about to be applied to Marin's document the
following apply:

1) Both proposals agree on the same initial signaling (cipher suite for C->S
and empty RI for S->C)

2) For renegotiations:
   a) Martin's draft propose to update (fix) the Finished calculation
      and use the same signaling as in 1).
   b) Eric's draft suggest sending verify_data in RI extensions and keep the
      old Finished calculation.

Many members of this list argue that 2a has better security properties and
is simpler to deploy (especially for legacy implementations).
The arguments for 2b seems to be that it is "good enough" and "why should we
care about old legacy implementations".

Now, maybe I'm wrong about that, but wouldn't it at least be fair to ask the
working group which approach they prefer?

/Stefan