Subject: Re: [TLS] I-D Action:draft-ietf-tls-renegotiation-00.txt

From: "Blumenthal, Uri - 0662 - MITLL" <[email-masked]>
Date: Sun, 22 Nov 2009 08:43:45 -0500

Sounds like a reasonable option.

----- Original Message -----
From: [email-masked] <[email-masked]>
To: [email-masked] <[email-masked]>
Sent: Sun Nov 22 01:29:10 2009
Subject: Re: [TLS] I-D Action:draft-ietf-tls-renegotiation-00.txt

David-Sarah Hopwood wrote:
> Martin Rex wrote:
>> Michael Stone wrote:
>>> Second, we believe that changing the definition of the Finished message
>>> should not be done without increasing the protocol version number.
>>
>> Yet another misunderstanding.
>> I haven't seen anyone talking about changing the definition of the
>> Finished message.
> 
> I think that's a perfectly reasonable option, for example:
> 
>   verify_data =
>     PRF(master_secret, finished_label, Hash(handshake_messages),
>         previous_verify_data)
>       [0..verify_data_length-1];

Minor notational error -- that should be

    verify_data =
      PRF(master_secret, finished_label, Hash(handshake_messages)
                                         + previous_verify_data)
        [0..verify_data_length-1];

> and I see no reason to exclude this option from consideration. Note that
> this would obviate any confusion about where the previous_verify_data
> goes in the handshake messages, or how it is encoded. More importantly,
> it guarantees that that the input to the PRF for the modified Finished
> computation cannot coincide with any possible input for the unmodified
> computation, which is a useful property that simplifies the security
> analysis.

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com

---

From: Martin Rex <[email-masked]>
Date: Sun, 22 Nov 2009 22:54:46 +0100 (MET)

>         [0..verify_data_length-1];

I would definitely add it into Hash(handshake_messages) and following
ServerHello, so that it gets automatically signed if client cert
authentication is used without any further changes.

> > computation, which is a useful property that simplifies the security

In the original TLS protocol, the verify_data from Client.Finished
is added into Server.Finished as part of the Hash(handshake_messages).

And that Server.Finished is what authenticates the entire TLS session
including the Server (with its Certificate) to the client.

So I don't think that making the Finished messages, which were
the first data exchanged under the current TLS sessions, part
of the Handshake message hash is a new concept that is completely
new to TLS.

-Martin