Re: [TLS] Fwd: Re: AD review of draft-ietf-tls-dtls-connection-id-07

[Achim Kraus <[e-mail]>]

Hi Ilari,

> The problem is the follows:
>
> Take the following input to the MAC (MtE case):
>
> <seqnum> 19 FE FD 63 01 00 05 04 00 02 FF 17
>
> There is no way to tell from that input if it is:
>
> - Application record on CID 63 containing 04 00 02 FF, or
> - Application record on CID 63 01 00 05 containing FF.
>

Maybe you check your example?

Does the 1. assume cid-length := 1?
And the 2. cid-length := 4?


The dtls-record will then contain:

(remove cid-length 01, cid-length is NOT encoded in the dtls-record!)

19 FE FD <seqnum> 63 00 05 04 00 02 FF 17

or

(remove cid-length 04)

19 FE FD <seqnum> 63 01 00 05 00 02 FF 17

For me this seems to be different input to the MAC, if the cid-length is
left out. My feeling is, your example proves my opinion, that it's
better to remove the cid-length from the MAC.

best regards
Achim Kraus