Re: [TLS] What would be the point of removing signalling in TLS 1.3?

[David-Sarah Hopwood <[e-mail]>]

[top-posting fixed]

Stefan Santesson wrote:
> On 09-11-26 8:01 PM, "David-Sarah Hopwood" <[e-mail]>
> wrote:
> 
>> Stefan Santesson wrote:
>>> Consequently, if we design an updated Finished calculation now, we can keep
>>> that in TLS 1.3 and just remove the signaling we now add for SSLv3 -> TLS
>>> 1.2.
>>
>> I really don't see any advantage in removing the signalling in TLS 1.3.
>> It doesn't simplify anything.
>>
>> For removing the signalling to work, we would have to specify in the
>> *current* fix that:
>>
>>  - sending a client version of {0x03, 0x04} or higher has the same
>>    meaning as sending the client->server signal.
>>
>>  - negotiating {0x03, 0x04} or higher has the same meaning as sending
>>    the server->client signal.
[...]
>
> If you fix the Finished message calculation, making it immune to the
> renegotiation attack, and making it the standard Finished calculation for
> 1.3.... Then why would you need to signal that you are using the standard
> Finished calculation?

Suppose that a client is "strict", i.e. only wants to connect to patched
servers. Since it doesn't know in advance that the server supports TLS 1.3,
then it must send the c->s signal in order to find out whether the server
is patched. If the c->s signal is not sent, then the s->c signal can't be
sent either, so the client wouldn't know whether the server was patched,
whenever TLS 1.2 or earlier is negotiated.

This is important because an initial handshake by a patched client can
correspond to a renegotiation at an unpatched server. So, it isn't
sufficient that the client uses the updated Finished computation for
renegotiations.

Sending a client version >= TLS 1.3 can be treated as implying the c->s
signal, and negotiating TLS 1.3 can be treated as implying the s->c signal,
but this won't eliminate any of the code that was handling signalling for
downrev versions. So this just adds code paths; it doesn't remove any.

Of course, it is possible that at some point in the fairly distant future,
TLS 1.3 will be the *minimum* version that a given implementation will
negotiate. At that point there would be a potential simplification -- but
it isn't at all clear that it outweighs the complication until then.
(Note: I have a "Buxton index" of about 20 years, and I still don't think
this eventual simplification is worthwhile.)

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com