[TLS] DTLS implementation questions

["Joseph Salowey \(jsalowey\)" <jsalowey at cisco.com>]

We have noticed some inconsistencies between RFC 4347 and DTLS
implementations (in particular implementations based on OpenSSL).  There
may be some areas where the specification is not clear so we wanted to
make sure we understood the intention of the spec in these areas.

1. We notice that some implementations include the initial ClientHello
and the HelloVerifyRequest in the Finished message hash and
CertificateVerify message hash. Section 4.2.1 of RFC 4347 indicates that
the initial ClientHello and the HelloVerifyRequest should be excluded
from the Finished message hash, however it does not mention excluding
these messages from the CertificateVerify message hash.  We believe that
these messages should be excluded from both hashes in order to achieve
the intended DOS protection.  

2. We notice that the handshake "headers" are omitted in the hash
computation for the CertificateVerify and the Finished message in some
implementations.  Although the spec does not explicitly specify how the
hashes are constructed we believe it should be consistent with RFC 4346
and use the complete handshake message.  

Do these interpretations make sense? 

We have found other implementation issues that do not appear to derive
from specification interpretation.  They detailed here
http://groups.google.com/group/mailing.openssl.dev/browse_thread/thread/
84c7c55752393dd/fcbb1734be44c72b?lnk=gst&q=dtls&rnum=1#fcbb1734be44c72b.


Thanks,

Joe

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls