Re: [TLS] Quest for Unified Solution to TLS Renegotiation

[David-Sarah Hopwood <[e-mail]>]

Marsh Ray wrote:
> David-Sarah Hopwood wrote:
>> Michael D'Errico wrote:
>>>> Eric Rescorla wrote:
>>>>
>>>>>>    3) Incorporate previous verify_data into Finished calc.
>>>>> I'm not happy with this, actually.
>>> Would this work:
>>>
>>>      Finished  =  verify_data  XOR  previous_verify_data
>>
>> No. The previous_verify_data has to be in the input to the PRF
>> that also depends on the master_secret. If you just XOR it to
>> the output, then the attacker doesn't need to know the master_secret
>> in order to change the unmodified Finished to the modified one.
> 
> If I understand it correctly, Mitm could decrypt the renegotiated
> Finished message record, modify it, and re-encrypt it.
> Effectively this means the authentication and integrity guarantees on
> protocol could be no stronger than the encryption. That could be a
> significant weakening of the protocol's security.

The Finished messages are both encrypted and MAC'd, so to be more precise,
it would be dependent on the non-malleability of this authenticated
encryption. There is some redundancy in the SSL/TLS handshake design here;
it would be secure even if the Finished messages had not been encrypted
and MAC'd, for example. But there is no good reason to eliminate any part
of that redundancy.

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com