Subject: [TLS] Post-handshake Finished when rejecting a CertificateRequest

From: Martin Thomson <[email-masked]>
Date: Tue, 2 Aug 2016 15:03:13 +1000

https://github.com/tlswg/tls13-spec/issues/572

Discuss.

---

From: Ilari Liusvaara <[email-masked]>
Date: Tue, 2 Aug 2016 10:48:54 +0300

> https://github.com/tlswg/tls13-spec/issues/572

Yeah, noticed that when trying to implement stuff. I do not see any
point in sending Finished in that case. Not sending Finished would
also make implementations that don't support post-handshake auth
simpler.

Also, what exact base key does that Finished use? Client's current
traffic secret at the beginning of the Finished (the sequence of
traffic secrets is the same client and server, but the values may
be out of sync.)?

I also noticed the hash forking issue. Even if I personally
nowadays deal with forkable hashes (even to the point of implmenting
multitap via forking) that is the only place forking is done.

However, those hash constructs look different from the ones in
handshake (not just different base context), which means those would
likely have to be implemented separtedly, increasing implmentation
effort.

However, if one wanted to use extra hashing there, so construction is
both compatible with the in-handshake one and doesn't require forking,
one would need to be a bit careful to stay out of cryptographic roughs.
E.g. it might be necressary to pad the hash to multiple of hash input
blocksize (like how HMAC does such padding with the key).

-Ilari

---

From: Martin Thomson <[email-masked]>
Date: Tue, 2 Aug 2016 20:40:08 +1000

> traffic secrets is the same client and server, but the values may

Presumably it's the traffic_secret_N that is active at the start of
the sequence of messages; also presumably, the sequence of messages
cannot be interrupted by something like a KeyUpdate.

---

From: Ilari Liusvaara <[email-masked]>
Date: Tue, 2 Aug 2016 15:25:46 +0300

> cannot be interrupted by something like a KeyUpdate.

It can't be interrupted by KeyUpdate from client, but can be interrupted
by KeyUpdate by server.

(Also, I think base key only appears in Finished).

-Ilari

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 2 Aug 2016 05:54:17 -0700

> It can't be interrupted by KeyUpdate from client, but can be interrupted

Not sure why that matters. Key Updates are unidirectional. I think it
clearly has to
be sender's.

-Ekr

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>