Re: [TLS] Quest for Unified Solution to TLS Renegotiation

[Martin Rex <[e-mail]>]

Eric Rescorla wrote:
> 
> At Wed, 25 Nov 2009 15:19:51 -0800,
> Michael D'Errico wrote:
> > The complaint I have about sending the verify_data over the wire is
> > that that alone does not plug the hole.  You need to take the extra
> > step to check that it's correct, and a maintenance programmer not
> > intimately familiar with TLS might miss this fact.
> 
> I don't find this argument very compelling. There are all sorts of
> ways to screw up your TLS implementation that are worse than this
> and are difficult/impossible to detect from the other side. E.g.,

The compelling reason is, that when we define TLSv1.3 then we
could stop sending the TLS extension RI entirely for TLS sessions
negotiated to use TLSv1.3.

If we use the band-aid TLS-extension-RI-with-verify-data to put the
verify data from the last handshake into the renegotiation, we will
need to contine apply this band-aid eternally.


-Martin