Subject: Re: [TLS] The consensus is half-mistaken (Re: Confirming consensus for ALPN)

From: Peter Gutmann <[email-masked]>
Date: Thu, 21 Mar 2013 04:41:47 +0000

Martin Rex <[email-masked]> writes:

>You mean something like a TLS protected extensions handshake message that is
>inserted between the CCS and the Finished handshake message on both
>directions, becoming the first protected message and still being
>covered/authenticated by the handshake message hash?
>
>Only for the initial aka "full" TLS handshake (because on the abbreviated aka
>"session resume" handshake, the sequence of the CCS&Finished is reversed, i.e.
>the Server sends the first Finished handshake message and the Client confirms
>it), or on both handshake types?
>
>Or are you thinking of exchanging protected extensions _after_ the Finished
>handshake message(s)?

Yes.

(I'm happy to be persuaded that either is better, but if I said I wanted #1
and not #2 it'd split things even further.  At the moment I'd just like to get
away from the idea that we're required to choose between kludge A and kludge
B, and then have to revisit the whole thing every few months when someone
wants another new extension added.

If I have to express a preference I'd go for option #2, mirroring how STARTTLS
et al work).

Peter.