Re: [TLS] A not-so crazy idea

[Yair Elharrar <[e-mail]>]

What if we just change the definition of the server's FINISHED message a bit; instead of sending
    Hash(handshake_msgs)
to the client, the server will send
    Hash(handshake_msgs || verify_data)
using the session's previous verify_data.
There's no change to initial handshakes, of course, as there's no previous verify_data.

This means:
1. Patched client and patched server: renegotiation is safe.
2. Patched client, unpatched server: the client can calculate Hash(handshake_msgs) and tell that the server is unpatched. It is up to the client to decide whether to abort the session or not.
3. Unpatched client, patched server: renegotiation will fail, as it should.


Yair
--

This email and any files transmitted with it are confidential material. They are intended solely for the use of the designated individual or entity to whom they are addressed. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, use, distribution or copying of this communication is strictly prohibited and may be unlawful.

If you have received this email in error please immediately notify the sender and delete or destroy any copy of this message