Re: [TLS] Signed messages should be prefixed with a NUL-terminated context string.

[Ilari Liusvaara <[e-mail]>]

On Wed, Dec 24, 2014 at 10:21:58AM -0800, Eric Rescorla wrote:
> On Tue, Dec 23, 2014 at 6:37 AM, Ilari Liusvaara <
> [e-mail]> wrote:
> 
> > On Mon, Dec 22, 2014 at 01:38:36PM -0800, Eric Rescorla wrote:
> > > Adam updated his PR to sign the prefix concatenated with the handshake
> > > hashes, which makes it easier to have a single hash context.
> > >
> > > https://github.com/tlswg/tls13-spec/pull/100
> > >
> > > I haven't seen any objections to this idea, so I'll merge this on
> > Wednesday
> > > unless I hear an objection before then.
> > >
> >
> > Any reason not to fix the hash function per-ciphersuite, so servers
> > and clients don't have to run multiple hashes in parrallel?
> >
> 
> The client and server may want to use different signature algorithms.

I mean the hash in data to be signed (not the internal hash function in
signature algortithm).

That is, it would be digital signature of:

- 32 padding bytes (or ClientRandom)
- 32 padding bytes (or ServerRandom)
- Context string
- Ciphersuite ID (to provode domain separation)
- handshake_hash(transcript)

Where handshake_hash is the same hash as used by session hash (that one
better be CR anyway!)

This PR lacks the domain separation and requires both sides to buffer
handshake or run potentailly lots of hashes (instead of just running
one they need to run anyway).



-Ilari