Re: [TLS] WGLC: draft-ietf-tls-session-hash

[Stephen Checkoway <[e-mail]>]

On Nov 23, 2014, at 2:49 PM, Sean Turner <[e-mail]> wrote:

> This is the working group last call for http://datatracker.ietf.org/doc/draft-ietf-tls-session-hash/.  Please review the document and send your comments to the list by Friday, December 12, 2014.  

Minor editorial comments:

   Synchronization of the "verify_data" in abbreviated handshakes also
   undermines the security guarantees of the renegotiation indication
   extension [RFC5746], re-enabling a prefix-injection flaw similar to
   the renegotiation attack [Ray09].  However, in a triple handshake
   attack, the client sees the server certificate changing across
   different full handshakes.  Hence, a precondition to mount this stage
   of the attack is that the client accepts different certificates at
   each handshake, even if their common names do not match.  Before the
   triple handshake attack was discovered, this used to be widespread
   behavior, at least among some web browsers, that where hence
   vulnerable to the attack.

1. I think it should be "...accepts different certificates _for_ each handshake..."
2. I'm not entirely sure what the final sentence is saying. It doesn't make sense for "the attack" to refer to the triple handshake attack (which is the most recently mentioned attack). Is it saying that browsers were vulnerable to a prefix-injection attack à la the renegotiation attack (which is referred to as a flaw rather than attack in the paragraph)?
3. "that where hence" should be something else, but I'm not sure what exactly that sentence means.

-- 
Stephen Checkoway