Re: [TLS] Protected Renegotiation -- refined proposal

[Martin Rex <[e-mail]>]

Two inaccuracies in my last posting:

Martin Rex wrote:
> 
>     Renegotiation SSL/TLS handshake on a connection
> 
>     TLS extension RI:
> 
>          ClientHello
>          FF 01 00 01 0C
>          <verify_data of client's previous client.finished>
>          ServerHello
>          FF 01 00 01 18
>          <verify_data of server's previous client.finished>
>          <verify_data of server's previous server.finished>
>          -- all further handshake messages unchanged ---

Mike quite helpfully pointed out that I got the length fields wrong
in my illustration for the TLS extensions, they would rather look like
   FF 01 00 0D 0C
   FF 01 00 19 18

> 
>     My (revised) proposal:
> 
>        The Handshake Messages MAC will roughly receive the following data:
> 
>       Client-side:
> 
>        ClientHello
>        ServerHello
>        <verify_data of client's previous client.finished>
>        <verify_data of client's previous server.finished>
>        -- all further handshake messages unchanged ---
>      
>       Server-side:
> 
>        ClientHello
>        ServerHello
>        <verify_data of server's previous client.finished>
>        <verify_data of server's previous server.finished>
>        -- all further handshake messages unchanged ---

Any in my (revised) proposal, the ClientHello and ServerHello would
contain the signaling C->S (special ciphersuite ID) and S->C (protocol
version with 0x04 major number) in both handshakes, initial and
renegotiation.


-Martin