Re: [TLS] Verify data in the RI extension?

[Stefan Santesson <[e-mail]>]

The current draft-ietf-tls-renegotiation-01.txt still promotes RI extension
containing verify_data from previous handshake.

Sorry for repeating my question, but I would be really interested to know
why this is considered a better security design, than to simply send an
empty RI (and to feed the values directly into Finished calculation without
exchange).

To me it seems obvious that the best security design is to NOT exchange this
data if the objective is to verify that the parties already hold the data.

It's feels like "I want proof that you hold this value, so I'm going to send
it to you".

/Stefan




On 09-11-26 9:51 AM, "Yoav Nir" <[e-mail]> wrote:

>> 1) Empty RI It's good security design
>> 
>> If you want to make sure two parties agree on a value that they have derived
>> from a previous state, in order to bind to the previous state, then why
>> would you exchange that value before doing the check?
>> 
>> On the contrary, I find it to be good security design not to exchange that
>> value as it:
>> 
>> 1) Reduce information leakage to an attacker
>> 2) Increase the security assumptions that can be made based on a proof of
>> matching values (good Finished messages).
>> 
>> Even if there are no attack today to exploit the information leakage and
>> exchanging the values allows secure design, I still find it valuable to
>> apply the best possible security design to reduce the chance of future
>> problems. 
> 
> Agree