Re: [TLS] client and server verify_data in

[Martin Rex <[e-mail]>]

Robert Dugal wrote:
> 
> A co-worker an I have been discussing the draft and have some concerns
> about sending client and server verify_data in the extension.
> 
> This data is not normally sent in the clear and I am wondering if this
> will provide additional data that can be used to mount some other form
> of attack.   

This particular issue is a misunderstanding of how this extension works.

The TLS Renegotiation_Info contains the verify_data of the
client.finished (ExtendedClientHello) and
client.finished | server.finished (ExtendedServerHello)

_ONLY_ on the renegotiation handshake, which happens under the
protection of the active TLS session.  The very same verify_data
was actually transferred under exactly this same protection as
the very first message.


As described in my recent proposal, it is not necessary to
send this data at all.  Just devise a different instruction
to have TLS at either end include its local copy of this
previous handshake verify_data in the handshake message hash
that goes into the Finished calculation of the new handshake
(as well as the VerifyCertificate calculation when client-cert is used)
and you get the same effect with respect to including the
previous session in the authentication of the new session.

-Martin