[TLS] question on draft-ietf-tls-session-hash-03

[Tony Hansen <[e-mail]>]

I have a question on draft-ietf-tls-session-hash-03. In the description 
I see:

    As described in [TRIPLE-HS  <https://tools.ietf.org/html/draft-ietf-tls-session-hash-03#ref-TRIPLE-HS>], in both the RSA and DHE key exchanges,
    an active attacker can synchronize two TLS sessions so that they
    share the same "master_secret".  For an RSA key exchange where the
    client is unauthenticated, this is achieved as follows.  Suppose a
    client, C, connects to a malicious server, A.  A then connects to a
    server, S, and completes both handshakes.  For simplicity, assume
    that C and S only use RSA ciphersuites.  (Note that C thinks it is
    connecting to A and is oblivious of S's involvement.)

My question is on the parenthetical comment at the end. I'll repeat it 
here, expanding C, S and A into CLIENT, SERVER and ATTACKER, respectively:

					(Note that CLIENT thinks it is
    connecting to ATTACKER and is oblivious of SERVER's involvement.)


Am I wrong in thinking that A and S are reversed here, and this should read:

					(Note that CLIENT thinks it is
    connecting to SERVER and is oblivious of ATTACKER's involvement.)


Or, removing the expansion:

					(Note that C thinks it is
    connecting to S and is oblivious of A's involvement.)


That is, ATTACKER A is the malicious man in the middle that the client 
is not aware of. (For that matter, the server is also probably oblivious 
of A's involvement.)

     Tony Hansen