Re: [TLS] Redefine Finished message for TLS 1.3 ?

[Martin Rex <[e-mail]>]

Nelson B Bolyard wrote:
> 
> I proposed that a change in the computation of the TLS Finished message
> to include some value derived from the master secret previously in use on
> the connection before the current renegotiation (such as the Finished
> message contents or some other value "extracted" from the master secret)
> would avoid the overhead of the new extensions on the wire.  My goal was
> to avoid the extra bandwidth and memory cost of those extensions, which
> might be deemed too costly in certain low memory or bandwidth constrained
> applications.
> 
> Others in the meeting responded that changing the definition of the
> computation of the Finished messages was a change to the base protocol
> specification (which adding an extension is not), and thus the change
> I proposed would make TLS become (say) TLS 1.3.

Well, we have a security flaw in the base spec, specifically in the
computation of the Finished messages for the TLS renegotiation, because
it fails to provide a cryptographic binding to the session that is
replaced.

The correct approach to fix a defect in the base protocol is, of course,
to fix the base protocol.  The defect is specific to the TLS renegotiation
and is so severe, that the IETF ought to strongly discourage any future
use of the defective protocol feature.  The negotiation will provide
sufficient information to vendors and implementors to decide on their
own whether and when to still support the defective protocol feature.


TLS extensions are fairly new, cause interop problems and are purely
optional protocol features.  TLS extensions are _not_ part of the base
spec of SSLv3, TLSv1.0 and TLSv1.1.  

The fix for this defect in the TLS renegotiation should be as close to
mandatory as it can be and for all implementations of SSL/TLS independent
of their protocol levels (SSLv3,TLSv1.0,TLSv1.1,TLSv1.2).

The more I think about it, the more I'm opposed to using
TLS extensions to wrap this fix.  It's just to urgent and serious
to spend such an amount of time on a fancy wrapping.

-Martin