Re: [TLS] [kitten] RFC 5929 tls-unique clarification?

[Michael D'Errico <[e-mail]>]

A Finished message does not have a length byte, even in TLS 1.2.  Square
brackets in the definition mean the data is a fixed size.  TLS 1.2 does
allow a cipher suite to change the size of the verify_data to something
other than 12, but that does not mean a length byte is included in the
Finished message.  Angle brackets would have been used in the definition
if that were the case.

Mike



Marsh Ray wrote:
> On 11/06/2010 05:53 AM, Nikos Mavrogiannopoulos wrote:
>> On 11/06/2010 01:00 AM, Martin Rex wrote:
>>>
>>> rfc5929 clearly says "Finished struct", which differs from the
>>> verify_data as used by rfc5246 (TLS extension RI) in that
>>> it WILL include the length field of the verify_data opaque vector.
>>
>> Does verify_data[] have a length field? It is not a variable length
>> vector to require length.
> 
> http://tools.ietf.org/html/rfc5246
>> 1.2.  Major Differences from TLS 1.1
>>    -  Verify_data length now depends on the cipher suite (default is
>>       still 12).
> 
> In theory, it's variable starting with TLS 1.2. Last I checked it seemed 
> like all cipher suites still define it as 12.
> 
> - Marsh