Re: [TLS] Quest for Unified Solution to TLS Renegotiation

[Martin Rex <[e-mail]>]

David-Sarah Hopwood wrote:
> 
> This approach and RI have different security properties: because RI
> does not change the Finished computation, it relies on the recipient
> of the extension checking that its contents are correct.
> 
> OTOH, I think it's only necessary for the previous verify_data to
> be sent once. So, how about sending that only in the ServerHello, i.e.

That is MUCH worse.

Normally the TLS handshake is symmetric, each one proves each other
(like with the Finished messages).

Client re-sending Client.Finished and Server re-sending Server.Finished
would still be symmetric (and both need to check).

If only one side sends and the other must check, then this is
asymmetric, and if the one side that is supposed to check
forgets it, then you have a security problem.

When each one resends. then both must forget to check to
make that security problem.

-Martin