Re: [TLS] Verify data in the RI extension?

[David-Sarah Hopwood <[e-mail]>]

Michael D'Errico wrote:
> David-Sarah Hopwood wrote:
>> No, a valid Finished message would have to include a verify_data hash
>> (36 bytes in SSLv3; 12 bytes or more in TLS). It isn't plausible to
>> suppose that an implementation that is secure in other respects would
>> just ignore an extra Finished message of the wrong length and not
>> containing the right hash.
> 
> I meant "well-formed", not valid, sorry.  It is plausible to think that
> a peer might ignore an empty Finished message, if you believe it can be
> broken in the way that would allow the theoretical attack to succeed.
> 
> Making the "fake_length" extend beyond the end of the PreviousVerifyData
> completely solves this since it would cause the peer to read parts of
> the subsequent valid messages into the fake Finished message.  Thus the
> Certificate message would be lost, making it impossible for the handshake
> to succeed.
> 
> And if that doesn't convince you, would you agree that changing the length
> wouldn't hurt anything?  If so, then you can appease me by making it
> 0xFFFFFF instead of zero.

I have no problem with this. By all means make it 0xFFFFFF.

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com