Re: [TLS] Verify data in the RI extension?

[Martin Rex <[e-mail]>]

Eric Rescorla wrote:
> 
> At Fri, 27 Nov 2009 16:27:03 +0100 (MET),
> Martin Rex wrote:
> > 
> > That problem can be trivially fixed.
> > 
> > We just memorize the non-encrypted Client.Finished and Server.Finished
> > handshake messages in full, rather then just the contained verify_data.
> 
> Woah, that's scary....
> 
> We're going to take the exact messages that previously appeared on the
> wire and inject them into the handshake hashes in order to *reduce*
> ambiguity in the hash input stream? I mean, maybe that's OK, but it
> sure isn't obviously OK.

What we would be doing is limiting the ambiguity with something
arbitrary to the ambiguity with a very well-defined handshake
message (actually, two of them).  

-Martin