Subject: [TLS] Transcript-Hash during Handshake

From: "Le Van Gong, Hubert" <[email-masked]>
Date: Tue, 21 Nov 2017 19:38:16 -0800

Greetings,

Probably a trivial question but is the transcript hash (during 
handhsake) calculated over decrypted versions of messages like 
EncryptedExtensions or certificate or is it done over the raw/encrypted 
messages?
I could not find an exact confirmation in the spec.

Cheers,
Hubert

---

From: Peter Wu <[email-masked]>
Date: Wed, 22 Nov 2017 03:59:15 +0000

Hi Hubert,

On Tue, Nov 21, 2017 at 07:38:16PM -0800, Le Van Gong, Hubert wrote:
> Greetings,
> 
> Probably a trivial question but is the transcript hash (during handhsake)
> calculated over decrypted versions of messages like EncryptedExtensions or
> certificate or is it done over the raw/encrypted messages?

It covers the decrypted handshake messages, see
https://tools.ietf.org/html/draft-ietf-tls-tls13-21#section-4.4.1

    This value is computed by hashing the concatenation
    of each included handshake message, including the handshake message
    header carrying the handshake message type and length fields, but not
    including record layer headers

(The only way to know the message type is to have it in cleartext.)
-- 
Kind regards,
Peter Wu
https://lekensteyn.nl

---

From: "Le Van Gong, Hubert" <[email-masked]>
Date: Tue, 21 Nov 2017 20:36:45 -0800

Hi Peter,

Yes, that sentence is what made me think it must be over decrypted messages but I wanted to double check as it's not clearly stated.
Thanks for confirming!

Hubert

---

From: Andrei Popov <[email-masked]>
Date: Thu, 23 Nov 2017 19:42:12 +0000

To confirm, TLSInnerPlaintext.type and TLSInnerPlaintext.zeros are not part of the handshake messages, and therefore are not included in the transcript hash?

Cheers,

Andrei

-----Original Message-----
From: TLS [mailto:[email-masked]] On Behalf Of Peter Wu
Sent: Tuesday, November 21, 2017 7:59 PM
To: Le Van Gong, Hubert <[email-masked]>
Cc: [email-masked]
Subject: Re: [TLS] Transcript-Hash during Handshake

Hi Hubert,

On Tue, Nov 21, 2017 at 07:38:16PM -0800, Le Van Gong, Hubert wrote:
> EncryptedExtensions or certificate or is it done over the raw/encrypted messages?

It covers the decrypted handshake messages, see
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-ietf-tls-tls13-21%23section-4.4.1&data=02%7C01%7CAndrei.Popov%40microsoft.com%7C5f27ddaec3b4434c6d8c08d5315d6d6b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636469199703666199&sdata=KKJRCPF%2BNTbh0LGMZG2zRZQW9NK8tgeP1Ws07n4Wanc%3D&reserved=0

(The only way to know the message type is to have it in cleartext.)
--
Kind regards,
Peter Wu
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flekensteyn.nl&data=02%7C01%7CAndrei.Popov%40microsoft.com%7C5f27ddaec3b4434c6d8c08d5315d6d6b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636469199703666199&sdata=aRZZ0GYkqQEaHN1lsEXjAjetzsXgfnRiITpqulNoFYk%3D&reserved=0

_______________________________________________
TLS mailing list
[email-masked]
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Ftls&data=02%7C01%7CAndrei.Popov%40microsoft.com%7C5f27ddaec3b4434c6d8c08d5315d6d6b%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636469199703666199&sdata=IDfdpwgg1JsBr%2BijxbZvRRzVVb5i5D3aIuEttiR0eDk%3D&reserved=0

---

From: Ilari Liusvaara <[email-masked]>
Date: Thu, 23 Nov 2017 21:51:57 +0200

On Thu, Nov 23, 2017 at 07:42:12PM +0000, Andrei Popov wrote:
> To confirm, TLSInnerPlaintext.type and TLSInnerPlaintext.zeros are
> not part of the handshake messages, and therefore are not included
> in the transcript hash?

Correct. The transcript hash is also not affected by fragmentation.

E.g. in TLS 1.3, the raw finished messag fed to SHA-256 is always
14 00 00 20 <32 bytes payload>. Regardless of padding and
fragmnentation (for SHA-384, that would be 14 00 00 30 <48 bytes
payload>).

(In DTLS, the header would be different and larger, but also
not affected by padding and fragmentation).

-Ilari

---

From: Andrei Popov <[email-masked]>
Date: Thu, 23 Nov 2017 19:58:56 +0000

Thanks, Ilari!

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Thursday, November 23, 2017 11:52 AM
To: Andrei Popov <[email-masked]>
Cc: Peter Wu <[email-masked]>; Le Van Gong, Hubert <[email-masked]>; [email-masked]
Subject: Re: [TLS] Transcript-Hash during Handshake

On Thu, Nov 23, 2017 at 07:42:12PM +0000, Andrei Popov wrote:
> To confirm, TLSInnerPlaintext.type and TLSInnerPlaintext.zeros are not 
> part of the handshake messages, and therefore are not included in the 
> transcript hash?

E.g. in TLS 1.3, the raw finished messag fed to SHA-256 is always
14 00 00 20 <32 bytes payload>. Regardless of padding and fragmnentation (for SHA-384, that would be 14 00 00 30 <48 bytes
payload>).

(In DTLS, the header would be different and larger, but also not affected by padding and fragmentation).

-Ilari