Re: [TLS] Verify data in the RI extension?

[Martin Rex <[e-mail]>]

Eric Rescorla wrote:
> 
> Woah, that's scary....
> 
> We're going to take the exact messages that previously appeared on the
> wire and inject them into the handshake hashes in order to *reduce*
> ambiguity in the hash input stream? I mean, maybe that's OK, but it
> sure isn't obviously OK.

A possible solution to avoid the ambiguity might look like the
following:

-Martin

ssl/s3_srvr.c:ssl3_send_server_hello()

    ret = ssl3_do_write(s,SSL3_RT_HANDSHAKE);
    if ( ret>0 ) {
        if ( s->s3->peer_is_updated || 0==s->s3->allow_old_renego ) {
            if ( s->s3->renegotiate ) {
                /* add previous Client.Finished to handshake msg hash */
                ssl3_finish_mac(s,s->s3->peer_finished,
                                  s->s3->peer_finished_len);
                /* add previous Server.Finished to handshake msg hash */
                ssl3_finish_mac(s,s->s3->finished,
                                  s->s3->finished_len);
            } else {
                /* add initial handshake msg hash differentiator */
                ssl3_finished_mac(s,"\x01\x55\xAA\x55", 4 );
            }
        }
        else
        {
            if ( s->s3->renegotiate ) {
                /* Servers SHOULD NOT offer old renegotiation anymore */
                /* if (0==(s->options&SSL_OP_ALLOW_INSECURE_RENEGOTIATE))*/
                ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
                ret = -1;
            }
        }
    }
    return(ret);