Re: [TLS] Comments on draft-rescorla-tls-renegotiate

[David-Sarah Hopwood <[e-mail]>]

Nicolas Williams wrote:
> Comments:
> 
> 1) The rest of this comment can be ignored if the use of protocol
>    extensions in draft-rescorla-tls-renegotiate is deemed to not be a
>    problem.
> 
>    I believe this problem can be fixed without using protocol extensions
>    at all.  All that has to be done is this: for re-negotiations the
>    Finished message computation changes from this:
> 
>     PRF(master_secret, finished_label, Hash(handshake_messages))
>        [0..verify_data_length-1];
> 
>    to:
> 
>     PRF(master_secret, finished_label,
> 	    Hash(handshake_messages || outer_connection_client_finished))
>        [0..verify_data_length-1];
> 
>    where outer_connection_client_finished is the client Finished message
>    for the previous/old/outer TLS connection
> 
>    There is no need to signal this!

The problem is that this unnecessarily breaks cases in which the
possibility of attack couldn't have been prevented (because only
one of the client and server supports the extension), and in which
there may actually be no attack.

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com