Re: [TLS] Verify data in the RI extension?

[Martin Rex <[e-mail]>]

[e-mail] wrote:
> 
> Martin Rex wrote:
> 
> > > For simplicity, the current draft is already very simple, and IMHO
> > > it's not clear that continuing to tweak it has a positive return
> > > on investment, considering it delays the publication.
> > 
> > Not really.
> > 
> > I ask this before: what should the original designers of the SSLv3
> > renegotiation have done from the beginning to make it secure.
> > Invent TLS extensions and then a TLS extension RI is definitely
> > _not_ the answer.  They would have fixed the handshake message hash
> > from the beginning.
> 
> I think "what would the SSLv3 designers have done" (almost 15 years
> ago) and "what should we today" are two completely different
> questions, which may have completely different answers.

If we were discussing a new feature for TLSv1.2 or TLSv1.3 only,
I would agree.

But we're actually going back to code that is 10 years or more
and want that fixed as well.  So we need to pay a little more
attention to the perils of poor souls from the dirty old cruft department
than to the dreams of the nerds from the fancy new features department.


-Martin