Re: [TLS] Verify data in the RI extension?

[Stefan Santesson <[e-mail]>]

On 09-11-30 1:14 AM, "Marsh Ray" <[e-mail]> wrote:

> Stefan Santesson wrote:
>> 
>> The real security advantage of implicit is that you know that the opponent
> 
> I agree that is possibly an advantage, but a very weak advantage.
> 

Well, It's not weak or strong in a cryptographic sense. The weakness is
totally dependent on whether implementers get this right or not. The problem
is that you can't tell whether they did since it doesn't show.
If they get it right, there is no weakness, if some or any get it wrong, it
may significantly reduce the value of this effort.

With implicit, implementers can't get it wrong and still produce a valid
finished message.

I personally think this is a significant advantage.

>> actually derived the same value from previous handshake. By sending it in RI
>> you don't know if the opponent just blindly accepted what you sent without
>> checking it. 
> 
> By that logic, how do you know that he's checking the Finished message hash?
> 

That you never know, but he wouldn't be able to produce a valid Finished
message unless he derived the accurate data from the previous handshake.

/Stefan

> - Marsh