Re: [TLS] First TLS cached information draft posted

[Simon Josefsson <simon at josefsson.org>]

Another minor point, quoting the document:

   When CachedInformationType identifies certificate_chain, then
   hash_value MUST include at least one hash value calculated over the
   certificate_list element of a server side Certificate message.
...
   When CachedInformationType identifies trusted_cas, then hash_value
   MUST include at least one hash value calculated over the
   certificate_authorities element of a server side CertificateRequest
   message.

And quoting RFC 5246 for the definitions of certificate_list and
certificate_authorities:

      opaque ASN.1Cert<1..2^24-1>;

      struct {
          ASN.1Cert certificate_list<0..2^24-1>;
      } Certificate;
...
      opaque DistinguishedName<1..2^16-1>;

      struct {
          ClientCertificateType certificate_types<1..2^8-1>;
          SignatureAndHashAlgorithm
            supported_signature_algorithms<2^16-1>;
          DistinguishedName certificate_authorities<0..2^16-1>;
      } CertificateRequest;

Q: Should the length bytes be included in the hash input or not?

/Simon