Re: [TLS] Verify data in the RI extension?

[Martin Rex <[e-mail]>]

Eric Rescorla wrote:
> 
>   This requires breaking the current clean definition of handshake
>   hashes as the hash of all the handshake messages and simply adding
>   some synthetic message in the middle.

"The current clean definition" of the handshake message hash is
what has gotten us into the trouble.

So we are not breaking it, we are fixing it.  We're not doing any
wire-format changes, so implementations that have not implemented
renegotiation at all are not even affected by this change.  That
is definitely much cleaner as having everyone run around with
a band-aid on their ClientHello and ServerHello handshake
messages when renegotiating.  It's encrypted, so most people
will not see it, but it's still there!


                                         I don't think this is anywhere
>   near as clean, as evidenced by the ongoing debate about whether to put
>   it the synthetic data in the front, the back, incorporate it into the
>   PRF, or chain the pre-existing handshake messages. [FWIW, I think I
>   prefer the last of these implicit versions.]

Making a rarely-used option that came several years after most of
the currently installed base a retroactive mandatory-to-implement
feature of the protocol, THAT is dirty and ugly.

-Martin