Re: [TLS] Redefine Finished message for TLS 1.3 ?

[David-Sarah Hopwood <[e-mail]>]

Marsh Ray wrote:
> Michael D'Errico wrote:
>> changing the Finished message calculation for renegotiations
>> does not protect a patched client when talking to an unpatched
>> server.
> 
> A patched client in 'secure' mode will have to refuse to handshake with
> an unpatched server.

Yes, but Michael's point was that changing the Finished message
calculation alone does not allow the client to know that it is
communicating with an unpatched server. The client's handshake is
initial, so it does not include the verify_data in the Finished
hash calculations, and neither does the server.

That's why a separate indication of patched status is needed
if you want to support the policy of refusing to connect to an
unpatched peer. OTOH, if you change the Finished message calculation
then this signalling is *only* needed to support that policy.

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com