Re: [TLS] Signed messages should be prefixed with a NUL-terminated context string.

[Eric Rescorla <[e-mail]>]

On Wed, Dec 24, 2014 at 10:50 AM, Ilari Liusvaara <
[e-mail]> wrote:

> On Wed, Dec 24, 2014 at 10:21:58AM -0800, Eric Rescorla wrote:
> > On Tue, Dec 23, 2014 at 6:37 AM, Ilari Liusvaara <
> > [e-mail]> wrote:
> >
> > > On Mon, Dec 22, 2014 at 01:38:36PM -0800, Eric Rescorla wrote:
> > > > Adam updated his PR to sign the prefix concatenated with the
> handshake
> > > > hashes, which makes it easier to have a single hash context.
> > > >
> > > > https://github.com/tlswg/tls13-spec/pull/100
> > > >
> > > > I haven't seen any objections to this idea, so I'll merge this on
> > > Wednesday
> > > > unless I hear an objection before then.
> > > >
> > >
> > > Any reason not to fix the hash function per-ciphersuite, so servers
> > > and clients don't have to run multiple hashes in parrallel?
> > >
> >
> > The client and server may want to use different signature algorithms.
>
> I mean the hash in data to be signed (not the internal hash function in
> signature algortithm).
>
> That is, it would be digital signature of:
>
> - 32 padding bytes (or ClientRandom)
> - 32 padding bytes (or ServerRandom)
> - Context string
> - Ciphersuite ID (to provode domain separation)
> - handshake_hash(transcript)
>

So to be clear, you are proposing that we might (for instance) have
a signature with (say) SHA-1 over a handshake hash computed with
SHA-256?

-Ekr



> This PR lacks the domain separation and requires both sides to buffer
> handshake or run potentailly lots of hashes (instead of just running
> one they need to run anyway).