Re: [TLS] Justification

[Nicolas Williams <[e-mail]>]

On Wed, May 12, 2010 at 02:46:32PM -0500, Marsh Ray wrote:
> On 5/12/2010 1:42 PM, Nicolas Williams wrote:
> > Paul Hoffman proposes an extension to add inputs to the Finished message
> > computation.  There's no objection yet to Paul's proposal on the grounds
> > you state.
> 
> I'm not sure the discussion got that far, so it's not evidence of much.

Fair enough.

> > In any case, one of the problems with the caching extension as proposed
> > result from not binding the cached objects to the Finished message,
> > which at the very least complicates the security analysis of the
> > protocol, and possibly compromises it altogether.  We MUST NOT make the
> > same mistakes we've made before.
> 
> Agreed, but we should be just as careful not to make new ones.

How could binding the cached objects into the handshake be a new mistake
given that we bind them in now?

> Sorry if you explained this earlier, but how would the "use URLs"
> approach be different than an arbitrary server-chosen identifier?

URIs would be useable across many servers, as opposed to server-assigned
IDs.  But this is not important.

I don't care how the objects are named.  I care only that they be bound
into the handshake.

(Earlier I had thought that we could avoid the SHA-1 vs. FNV-1a issue by
having server-assigned object IDs, however, that was incorrect.  It's
not how we name the objects but how we agree that two peers have the
same cached/cacheable objects that matters.  I'm sorry I even mentioned
server-assigned object IDs.  If I'd thought about it longer I'd have
understood the real problem earlier and avoided this little detour.)

Nico
--