[TLS] What is spliced

[Eric Rescorla <[e-mail]>]

There has been a bunch of discussion about what the introduction should
say about what is spliced together in this attack. Here's my proposed
new text, based on trying to integrate various comments from Nelson,
Marsh, etc.

This attack can be prevented by cryptographically binding
renegotiation handshakes to the enclosing TLS channel, or more
properly, to the TLS handshake which established the security
parameters over which the new handshake is being performed. This
prevents the attacker from splicing a negotiation occuring over one
set of security parameters (including the initial pre-handshake
set of TLS_NULL_WITH_NULL_NULL) into
another set of security parameters. An attempt by an attacker to
inject himself as described above will result in a mismatch of the
extension and can thus be detected. The data used in the extension is
similar to, but not the same as, the channel binding data used in
[I-D.altman-tls-channel-bindings], however this extension is not a
generic-purpose RFC 5056 channel binding facility.

Comments?

-Ekr