Re: [TLS] RESOLVED (Re: [sasl] lasgt call comments (st Call:

[Martin Rex <Martin.Rex at sap.com>]

Simon Josefsson wrote:
> 
> Martin Rex <Martin.Rex at sap.com> writes:
> 
> > It might be easier to _NOT_ key on the finished message, but on the
> > master secret instead.
> 
> That was my conclusion as well, hence
> http://tools.ietf.org/html/draft-josefsson-sasl-tls-cb-00
> which uses the TLS PRF interface.
> 
> For -02 I also added hashing the Finished message, to match the
> semantics for connection/session (regardless of its definition) of
> draft-altman-tls-channel-bindings, but I'd prefer to avoid it
> completely.

If you refer to the TLS-extractor interface with TLS PRF, that does
unconditionally include the client.random and server.random in the
computation and therefore the output will differ for different
incarnations (resumes) of the same TLS session.  That is 
comparable to keying to the _most_recent_ finished message -- with
__NO__ special cased for TLS session resume and TLS renogiation.

-Martin