Re: [TLS] draft-ray-tls-encrypted-handshake-00.txt

[Eric Rescorla <[e-mail]>]

On Wed, May 16, 2012 at 1:30 PM, Nico Williams <[e-mail]> wrote:
> Eric,
>
> In addition to Nikos' point I'd like to point out that it's not just
> the things this approach would protect today, but also the future
> extensions that it will also protect.  More importantly, I think
> starting cryptographic protection as early as possible is a good
> design goal in general.
>
> It is worth asking whether these changes are worthwhile, of course.
> Even if desirable, if they were to be too difficult to implement
> and/or deploy then desirability might not be sufficient.  But I think
> it's too soon to tell that this is too difficult to implement.  I
> don't think Marsh's proposal does quite as much violence to
> implementations as you seem to think, and in any case, that's a
> one-time hit.  The bigger concern for me is whether refactoring can be
> done so as to keep the complexity of implementation withing acceptable
> limits, but I think that must be possible anyways.

But as is already clear, this design doesn't actually give you protection
for all additional features: rather it interacts badly with a number of
existing features. There's no reason to think that other future
features wouldn't have similar problems.

-Ekr