Re: [TLS] A not-so crazy idea

[Yoav Nir <[e-mail]>]

That would mean that RFC-compliant clients just don't work. A change like that is fine for a future version, like 1.3, but changing the behavior of 1.0 in a non-compliant way is just wrong. You really have to signal it.

Of course, once you have a new version like 1.3, you don't need both old and new behavior.  There's jut the new, TLS 1.3 way of calculating the Finished message.
________________________________________
From: [e-mail] [[e-mail]] On Behalf Of Yair Elharrar [[e-mail]]
Sent: Sunday, November 15, 2009 22:35
To: [e-mail]
Subject: Re: [TLS] A not-so crazy idea

What if we just change the definition of the server's FINISHED message a bit; instead of sending
    Hash(handshake_msgs)
to the client, the server will send
    Hash(handshake_msgs || verify_data)
using the session's previous verify_data.
There's no change to initial handshakes, of course, as there's no previous verify_data.

This means:
1. Patched client and patched server: renegotiation is safe.
2. Patched client, unpatched server: the client can calculate Hash(handshake_msgs) and tell that the server is unpatched. It is up to the client to decide whether to abort the session or not.
3. Unpatched client, patched server: renegotiation will fail, as it should.


Yair
--