Re: [TLS] A crazy idea

[Marsh Ray <[e-mail]>]

Michael D'Errico wrote:
> Here's a crazy idea: we could define a completely incompatible change
> to the way Finished messages are calculated even on initial handshakes.

Or it could be as simple as flipping one bit in the verify_data.

> A client can initially try connecting using the new Finished message
> calculation, and if that fails, fall back to the original (if it's
> willing to risk talking to an unpatched server).

We can't change the app code.

> The server has the advantage of receiving the client's Finished message
> before it needs to send its own, so it can compute both the new and the
> old versions to see which the client supports.  Then it can decide
> whether to continue with the handshake or abort.  This also thwarts any
> tampering by a MITM since neither calculation would match if messages
> were altered.
> 
> For session resumption, each side would need to remember whether the
> new or the old Finished calculation was used.
> 
> Just throwing the idea out there....

We need all the ideas we can get.

Really, I think the harder problem is signaling in the initial hellos,
particularly the server hello. We need one unambiguous bit in each
direction, with a consistent default from unpatched endpoints.

- Marsh