Re: [TLS] RFC 4507bis

Mike and all,

  I would say that HMAC-SHA256 should be recomended.

-----Original Message-----
>From: Mike <mike-list@pobox.com>
>Sent: Jul 29, 2007 11:58 AM
>To: tls@ietf.org
>Subject: [TLS] RFC 4507bis
>
>I'm working on adding support for RFC 4507 to my code
>and have found a few issues with the draft.
>
>   - Should the NewSessionTicket message be included
>     in the hash used to create/verify the Finished
>     message.  I believe it should since it's a
>     handshake message, but it's not stated anywhere.
>     I think it would be a good idea to specifically
>     state that it is.
>
>   - Is it legal for the server to resume a session
>     and not provide a NewSessionTicket?  The message
>     flow I'm referring to would look like this:
>
>     Client                                    Server
>     ClientHello
>     (SessionTicket extension) -->
>                                          ServerHello
>                         (no SessionTicket extension)
>                                   [ChangeCipherSpec]
>                               <--           Finished
>     [ChangeCipherSpec]
>     Finished                  -->
>     Application Data          <->   Application Data
>
>     If this is not allowed, it should probably be
>     stated that when a server resumes a session using
>     a SessionTicket, it MUST send an empty Session
>     Ticket extension and a NewSessionTicket message
>     (optionally with an empty ticket).
>
>   - It may be useful to state that the MAC computation
>     in the ticket is over the encrypted contents to
>     be able to quickly reject a ticket and not have to
>     perform a decryption first.
>
>   - Should HMAC-SHA256 be recommended instead of
>     HMAC-SHA1?
>
>   - StatePlaintext needs more data fields when TLS
>     extensions are used such as max fragment length.
>     This should be obvious, but it wouldn't hurt to
>     state.
>
>Mike
>
>_______________________________________________
>TLS mailing list
>TLS@lists.ietf.org
>https://www1.ietf.org/mailman/listinfo/tls
Regards,
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 134k members/stakeholders strong!)
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail jwkckid1@ix.netcom.com
Registered Email addr with the USPS Contact Number: 214-244-4827

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls