Re: [TLS] Cached Info extension - Draft 01

[Stefan Santesson <stefan at aaa-sec.com>]

Martin,

On 09-07-02 1:00 AM, "Martin Rex" <Martin.Rex at sap.com> wrote:

> If the real data is no longer part of the SSL handshake, but instead
> either a weak hash or even a static "cache handle", then there is
> a change in the cryptographic properties of the SSL handshake using
> cached handshake data and the full handshake with the real data.

I don't believe this conclusion is correct.

The handshake will proceed exactly as it would have if the real data was
exchanged, preserving the cryptographic properties of a full handshake with
the original data.

This is true with only one exception. It changes the data used to calculate
the finished message. With cached data, the finished message is calculated
over the "weak" hashes instead of the original data.

For this to be turned into an attack, you have to make it plausible that one
could force two different TLS sessions to produce colliding finished
messages through a "weak" caching hash. This can't be the case if the hash
algorithm used to calculate the finished message is solid.