Re: [TLS] Perhaps there's another way. Was: Verify data in the RI extension?

[Marsh Ray <[e-mail]>]

Dr Stephen Henson wrote:
> Marsh Ray wrote:
>>
>> At the CCS, instead of replacing the client/server MAC secret data,
>> simply XOR-merge the incoming values with the previous ones.
>>
>> * A one-line software change.
>> * Easy even in hardware.
>> * Preserves more entropy.
>> * No changes to PRF.
> 
> I think this will give problems for external crypto libraries like PKCS#11 where
> session key derivation is a mechanism with fixed parameters and the actual keys
> are not available in plain text outside the hardware. You'd need to develop a
> new mechanism, add it to the PKCS#11 spec and update firmware on every piece of
> crypto hardware.

PKCS#11 looks like it defines structures for CK_SSL3_KEY_MAT_PARAMS and
CK_SSL3_KEY_MAT_OUT (these are also used by TLS).

So there are interfaces defined in hardware (or monolithic libraries)
that support feeding additional data into the Finished.verify_data
calculation but do not allow access to the MAC secrets?

*sigh*

Why was the Finished data shortened from 36 bytes in SSLv3 to 12 bytes
in TLS 1.0 anyway?

- Marsh