Re: [TLS] TLS v1.2 performance (was Re: TLSv1.2 with DSA client cert and

[Eric Rescorla <[e-mail]>]

On Thu, Feb 17, 2011 at 10:47 AM, Nikos Mavrogiannopoulos
<[e-mail]> wrote:
> On 02/17/2011 01:03 AM, Michael D'Errico wrote:
>> I see the potential problem.  For me, though, I just hold onto all
>> of the handshake messages until the handshake concludes.  It may use
>> a bit more memory for a short amount of time, but the issue you raise
>> is completely avoided.  Call it a space <-> code complexity
>> trade-off.
>
> Indeed. There is no other way to correctly implement TLS 1.2 except
> from holding a copy of all the handshake messages. This is problematic
> when converting an implementation of TLS 1.0 or 1.1 to that, since
> those protocols only required to hold the state of 1 or 2 running hashes.

Is that really true?. My memory from the discussions and briefly
refreshed by looking at the
doc is that you only need to hold the messages until you see the
ServerHello at which point
you know the PRF and so you can just start storing hashes.

Best,
-Ekr