Re: [TLS] TLS v1.2 performance (was Re: TLSv1.2 with DSA client cert and

[Nikos Mavrogiannopoulos <[e-mail]>]

On 02/17/2011 01:03 AM, Michael D'Errico wrote:
> I see the potential problem.  For me, though, I just hold onto all
> of the handshake messages until the handshake concludes.  It may use
> a bit more memory for a short amount of time, but the issue you raise
> is completely avoided.  Call it a space <-> code complexity
> trade-off.

Indeed. There is no other way to correctly implement TLS 1.2 except
from holding a copy of all the handshake messages. This is problematic
when converting an implementation of TLS 1.0 or 1.1 to that, since
those protocols only required to hold the state of 1 or 2 running hashes.

This is also not easy to fix in TLS 1.3. Even if TLS 1.3 only
requires to hold the state of a single hash, implementations
must be prepared to hold the entire state just in case TLS 1.2
is negotiated.

> This issue would have been avoided if the
> supported_signature_algorithms extension was symmetric and allowed
> the server to specify its list of algorithms in a ServerHello
> extension.  Alas, that was not the design we ended up with.

That was a bad design decision in TLS 1.2 (if we assume that not caching
all messages was a requirement).

regards,
Nikos