Re: [TLS] Verify data in the RI extension?

[Martin Rex <[e-mail]>]

Eric Rescorla wrote:
> > 
> > What we would be doing is limiting the ambiguity with something
> > arbitrary to the ambiguity with a very well-defined handshake
> > message (actually, two of them).  
> 
> Hmm...
> 
> Thinking about this some more, consider the case of a client which
> (improperly) ignores handshake messages which come out of sequence,
> but still hashes them into handshake hashes.

I did consider that, see the solution here:
http://www.ietf.org/mail-archive/web/tls/current/msg04920.html

this will make the initial and renegotiation handshake message
hash reliably distinct.

And btw. when a TLS peer ignores two incorrect finished messages
on a connection, then there are a lot more things to worry about.
Those are completely unlikely to get the TLS extension RI right.


-Martin