Re: [TLS] Transcript-Hash during Handshake

Ilari Liusvaara <ilariliusvaara@welho.com> Thu, 23 November 2017 19:52 UTC

Date: Thu, 23 Nov 2017 21:51:57 +0200
From: Ilari Liusvaara <ilariliusvaara@welho.com>
To: Andrei Popov <Andrei.Popov@microsoft.com>
Cc: Peter Wu <peter@lekensteyn.nl>, "Le Van Gong, Hubert" <hubert@levangong.org>, "tls@ietf.org" <tls@ietf.org>
Message-ID: <20171123195157.GB28646@LK-Perkele-VII>
References: <94ced158-63b1-e7a3-024c-44d1149e7202@levangong.org> <20171122035915.GD18321@al> <CY4PR21MB012013A8387575C18CB117D58C210@CY4PR21MB0120.namprd21.prod.outlook.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Disposition: inline
In-Reply-To: <CY4PR21MB012013A8387575C18CB117D58C210@CY4PR21MB0120.namprd21.prod.outlook.com>
User-Agent: Mutt/1.9.1 (2017-09-22)
Sender: ilariliusvaara@welho.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/uQirLgwPvFovE5aWa9uehPxXSFQ>
Subject: Re: [TLS] Transcript-Hash during Handshake
Precedence: list

On Thu, Nov 23, 2017 at 07:42:12PM +0000, Andrei Popov wrote:
> To confirm, TLSInnerPlaintext.type and TLSInnerPlaintext.zeros are
> not part of the handshake messages, and therefore are not included
> in the transcript hash?

Correct. The transcript hash is also not affected by fragmentation.

E.g. in TLS 1.3, the raw finished messag fed to SHA-256 is always
14 00 00 20 <32 bytes payload>. Regardless of padding and
fragmnentation (for SHA-384, that would be 14 00 00 30 <48 bytes
payload>).

(In DTLS, the header would be different and larger, but also
not affected by padding and fragmentation).


-Ilari

[TLS] Transcript-Hash during Handshake Le Van Gong, Hubert
Re: [TLS] Transcript-Hash during Handshake Peter Wu
Re: [TLS] Transcript-Hash during Handshake Le Van Gong, Hubert
Re: [TLS] Transcript-Hash during Handshake Andrei Popov
Re: [TLS] Transcript-Hash during Handshake Ilari Liusvaara
Re: [TLS] Transcript-Hash during Handshake Andrei Popov