Re: [TLS] Verify data in the RI extension?

[Eric Rescorla <[e-mail]>]

At Fri, 27 Nov 2009 16:41:15 +0100 (MET),
Martin Rex wrote:
> 
> Eric Rescorla wrote:
> > 
> >   This requires breaking the current clean definition of handshake
> >   hashes as the hash of all the handshake messages and simply adding
> >   some synthetic message in the middle.
> 
> "The current clean definition" of the handshake message hash is
> what has gotten us into the trouble.

I don't agree with this assessment of what the problem is.


> That
> is definitely much cleaner as having everyone run around with
> a band-aid on their ClientHello and ServerHello handshake
> messages when renegotiating.  It's encrypted, so most people
> will not see it, but it's still there!

Yes it's still there. So what?

Obviously, you and I have different opinions about what's "clean".


>                                          I don't think this is anywhere
> >   near as clean, as evidenced by the ongoing debate about whether to put
> >   it the synthetic data in the front, the back, incorporate it into the
> >   PRF, or chain the pre-existing handshake messages. [FWIW, I think I
> >   prefer the last of these implicit versions.]
> 
> Making a rarely-used option that came several years after most of
> the currently installed base a retroactive mandatory-to-implement
> feature of the protocol, THAT is dirty and ugly.

This seems like a generalized argument against using extensions at
all, not against putting the verify_data in the handshake.

-Ekr