[TLS] client and server verify_data in draft-rescorla-tls-renegotiate.txt

["Robert Dugal" <[e-mail]>]

A co-worker an I have been discussing the draft and have some concerns
about sending client and server verify_data in the extension.

In the ClientHello, the client sends the verify_data from the client's
previous Finish message as the renegotiated_connection data.

In the ServerHello, the server sends both the cient's verify_data and
the server's verify_data.

This data is not normally sent in the clear and I am wondering if this
will provide additional data that can be used to mount some other form
of attack .   

The only reason we are sending any data at all is to prove that the
renegotiation is bound to a previous handshake, so why not bind it with
some data that is on the wire and visible to everyone?

 

One possability is to use the client and server randoms as the
renegotiated_connection data.  This data is sent as plaintext on the
wire so it reveals nothing the attacker doesn't already know.

If these randoms are included in the client hello's
renegotiation_connection data  then they will also be included in the
client and server message hashes. 

Likewise, if they are missing from the renegotiation_connection data  an
attacker cannot add them or else client and server  message hashes will
mismatch and renegotiated handshake will fail.

 

Another alternative could be to use the client's encrypted Finish
message rather than the verify_data from Client's Finish message, and
server's encrypted Finish message.

Again both these data are sent on the wire so reveal nothing.  It's
probably easier to use the randoms as handshake and record layer may not
be able interchage data.

 

-- 

Robert Dugal                        Senior Software Developer

Certicom Corp.                    A Subsidiary of Research In Motion 

[e-mail]

direct        905.501.3848

fax             905.507.4230

www.certicom.com

 


---------------------------------------------------------------------
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.