Re: [TLS] TLS v1.2 performance (was Re: TLSv1.2 with DSA client cert and

[Nikos Mavrogiannopoulos <[e-mail]>]

On Thu, Feb 17, 2011 at 10:35 AM, Eric Rescorla <[e-mail]> wrote:

>>> I see the potential problem.  For me, though, I just hold onto all
>>> of the handshake messages until the handshake concludes.  It may use
>>> a bit more memory for a short amount of time, but the issue you raise
>>> is completely avoided.  Call it a space <-> code complexity
>>> trade-off.
>> Indeed. There is no other way to correctly implement TLS 1.2 except
>> from holding a copy of all the handshake messages. This is problematic
>> when converting an implementation of TLS 1.0 or 1.1 to that, since
>> those protocols only required to hold the state of 1 or 2 running hashes.
> Is that really true?. My memory from the discussions and briefly
> refreshed by looking at the
> doc is that you only need to hold the messages until you see the
> ServerHello at which point
> you know the PRF and so you can just start storing hashes.

Note that you're talking about the hashes required for the finished
messages and you're correct on this note. However there is also the
hash required for the CertificateVerify message. If the server requests
a client certificate then it has to store all messages up to (but not
including) the CertificateVerify message.
That is because he cannot possibly know which signature algorithm
hash the client will use.

In TLS 1.0 and 1.1 the same hashes as the ones in the finished
messages were being used, so that was not an issue.

regards,
Nikos