[TLS] Yet more on digests and Cached-Info

[Eric Rescorla <[e-mail]>]

As promised at the TLS WG meeting in Maastricht, here are my comments from
the mic about the nature of the digest in CachedObject:

1. The primary security property we are interested in here is second
preimage
resistance. Any useful attack that I can think of requires the attacker to
produce a new
CachedObject that has the same digest as one the server will accept (we
assume he can retrieve the server's CachedObjects). Thus, this is second
preimage.

2. As I understand the discussion, there were some concerns about the use
of a pure digest being weaker than the Finished messages. I think this is
unfounded.
Remember that in most cases the security of the handshake depends on second
preimage anyway, since a failure of 2nd preimage resistance implicates
certificates,
which are a much richer target.

3. It's actually not clear to me that the PRF is even equally strong here: I
would
have to think about it a bit, but it's not clear to me that PRFs actually
need to
exhibit 2nd preimage resistance when the key is known.

4. Tying the digest to the PRF is a problem because that depends on the
handshake
results which might not be the same for each handshake.


Accordingly, I propose the following:

1. The client offers one or more CachedObjects with any digests of his
choice.
2. If SignatureAlgorithms is offered (as required for TLS 1.2), those
digests MUST
    be in the associated HashAlgorithms (thus preserving the implicit
guarantee in
    point #1 above).

How does this sound to people?

-Ekr