Re: [TLS] Verify data in the RI extension?

[Eric Rescorla <[e-mail]>]

At Fri, 27 Nov 2009 16:08:54 +0100,
Stefan Santesson wrote:
> 
> No I don't have any scenario (and I said so).
> 
> This was part of a principal (theoretical) argument.

As Nikos says, I don't see how this argument has any force:

The basic design of TLS rehandshaking is that it's performed 
over the same channel as the original handshake. Therefore, by
definition the attacker already has the contents of the immediately
previous Finished.

-Ekr


> On 09-11-27 3:30 PM, "Nikos Mavrogiannopoulos" <[e-mail]> wrote:
> 
> > On Thu, Nov 26, 2009 at 10:28 AM, Stefan Santesson <[e-mail]> wrote:
> > 
> >> On the contrary, I find it to be good security design not to exchange that
> >> value as it:
> >> 
> >> 1) Reduce information leakage to an attacker
> > 
> > Hello,
> >  How would that be? What scenario do you have in mind? This value has
> > already been exchanged in the initial finished message exchange and
> > was protected under the same ciphersuite. Why would this exchange be
> > less secure? If the attacker can decrypt and see this value, then he
> > can also see the initial finished value. No new information is given
> > to him.
> > 
> > 
> > regards,
> > Nikos
> 
> 
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls