Re: [TLS] Wrapping up cached info

[Martin Rex <[e-mail]>]

Brian Smith wrote:
> 
> Stefan Santesson wrote:
> > I will, provided that this seems acceptable still in a few days from now,
> > write up a new draft that captures the changes which then hopefully can be
> > ready for a WGLC.
> 
> There's another issue still. If the server sends the client an information
> item X after the change cipher suite message, then the client must not send
> a hash of that information item in its client hello message on another
> connection, until it has verified the identity of the server on that second
> connection. In other words, the client must ensure that it doesn't leak
> information that would otherwise be confidential--including even certificate
> messages and client certificate cipher suite messages that were received
> over an encrypted connection.


I think that should be described in the Security Considerations that
a client or client&server that perform renegotiation for the purpose
of client identity protection may want to tag their cached values
so that when that value was established on an encrypted handshake,
it is not going to be proposed by the client on a successor
plaintext handshake.

-Martin