Re: [TLS] What does it mean to not include 0-RTT message in the handshake hash?

Christian Huitema <> Tue, 22 December 2015 02:26 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 085321AD0C9 for <>; Mon, 21 Dec 2015 18:26:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.002
X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 1dPWRv8dNAuX for <>; Mon, 21 Dec 2015 18:26:03 -0800 (PST)
Received: from ( [IPv6:2a01:111:f400:fc10::732]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 88D681AD0B4 for <>; Mon, 21 Dec 2015 18:26:03 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=selector1; h=From:To:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=8djJy0XkR/Cz2jXhOSf5pK9TZ5SOlPyb+P7u5Cc0H6Q=; b=a8baHyvssk4aMyI+xRCg9nLrr4vqtWndCwKV/kZYpwOfuNk1XYptxJxsNmW8OOXSW6eq16tERNf2KIz8SnVw9zFbhMnrBZHDuFF+c/Zj+oBF/7fNDf1scoqrknkCv02zXh2cPv6TdqY8F4se2RB9A8Xd2aM3YvbpbuF8ea/pVQg=
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.1.361.13; Tue, 22 Dec 2015 02:25:44 +0000
Received: from ([]) by ([]) with mapi id 15.01.0361.006; Tue, 22 Dec 2015 02:25:44 +0000
From: Christian Huitema <>
To: Eric Rescorla <>
Thread-Topic: [TLS] What does it mean to not include 0-RTT message in the handshake hash?
Thread-Index: AdE8WUzTusUbdu5EQyy4pojDDNAspQAA40EAAACQIQA=
Date: Tue, 22 Dec 2015 02:25:44 +0000
Message-ID: <>
References: <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
authentication-results: spf=none (sender IP is );
x-originating-ip: [2001:4898:80e8:c::7a9]
x-microsoft-exchange-diagnostics: 1; DM2PR0301MB0653; 5:XKAEDQFP3A5V8OT5/YRT4wDsCICu2rcjM+VzJ5lz32bJxvPnGoFiu3fGTGuaNtEyuHy+KU8kZDmUKSwAOMJe1G6ZiPTEdkGWMBXQ6DeXBoxA3ZA1zG0iSZuAOJnQAMUIrDF/mJ0EWMWcbGHCOqJgfQ==; 24:JCdkA4UP4Fv22YphQV6l8o8bLHZKf0LcFfhQTyDbWFfgVI/QvXivvCsmgr1+usahMBPSPPdwmaLw95mwg1wmrqIg/JIZqkKUzFqnkp7A0BE=
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:DM2PR0301MB0653;
x-microsoft-antispam-prvs: <>
x-exchange-antispam-report-test: UriScan:;
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(601004)(2401047)(520078)(5005006)(8121501046)(10201501046)(3002001)(61426038)(61427038); SRVR:DM2PR0301MB0653; BCL:0; PCL:0; RULEID:; SRVR:DM2PR0301MB0653;
x-forefront-prvs: 0798146F16
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(199003)(189002)(5001960100002)(189998001)(10090500001)(74316001)(81156007)(110136002)(1220700001)(1096002)(11100500001)(105586002)(106356001)(101416001)(97736004)(586003)(33656002)(99286002)(102836003)(77096005)(5008740100001)(54356999)(87936001)(86612001)(5004730100002)(76576001)(76176999)(86362001)(40100003)(50986999)(10400500002)(5005710100001)(10290500002)(8990500004)(5003600100002)(5002640100001)(92566002)(2950100001)(2900100001)(122556002)(6116002)(3826002); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR0301MB0653;; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en;
received-spf: None ( does not designate permitted sender hosts)
spamdiagnosticoutput: 1:23
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Dec 2015 02:25:44.7899 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR0301MB0653
Archived-At: <>
Cc: "" <>
Subject: Re: [TLS] What does it mean to not include 0-RTT message in the handshake hash?
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 22 Dec 2015 02:26:06 -0000

> You're referring the editor's copy (WIP-11), right?

> I was just going over this text today and realized it's kind of confusing
> (and the whole "handshake_hash" abstraction is starting to be less useful
> in light of the PR#316 reframing of the authentication block).

Yes, the "handshake hash" is indeed confusing. Specifying something like "all messages up to <some point>" is simple enough. But there are several such points, used at different stages. Server Hello, Server certificate verify, Server Finished, Client certificate verify, Client finished.. It would be a bit more clear to give each of them its own name.

> Unless I'm confused (which is possible given the time of night), 
> the intention, as you say, is to separate out the 0-RTT handshake
> messages i.e., (cert, cert verify, finished) from the 1-RTT computations.

OK. That does not simplify implementations using running hashes...

> Trying to figure out the best way to clarify this text. PRs welcome :)

Yes of course...

-- Christian Huitema