Re: [TLS] Quest for Unified Solution to TLS Renegotiation

[Martin Rex <[e-mail]>]

David-Sarah Hopwood wrote:
> 
> The old verify_data should not just be appended to the handshake_messages
> without any further encoding, though, because it might match the bytes
> of some valid handshake message. In that case, there is the possibility
> that a MITM might insert the old verify_data into the stream sent to
> one peer, as though it were a handshake message. If that peer is using
> the unmodified Finished computation (either because it is unpatched or
> it is doing an initial handshake), then it may end up computing the same
> Finished hash as the other peer that is using the modified computation.
> 
> I haven't gone through the details of this attack thoroughly enough
> to be sure it will work, but it is too near working for comfort.

There are no handshake messages after finished.

You forgot the signaling in the ServerHello and ClientHello
that is also covered by the handshake message hash.

the verify_data should be added directly following ServerHello.

-Martin