Re: [TLS] [CHANNEL-BINDING] RESOLVED (Re: [sasl] lasgt call comments (st Call:

[Nicolas Williams <Nicolas.Williams at sun.com>]

On Mon, Nov 02, 2009 at 04:55:48PM +0100, Simon Josefsson wrote:
> Martin Rex <Martin.Rex at sap.com> writes:
> 
> > It might be easier to _NOT_ key on the finished message, but on the
> > master secret instead.
> 
> That was my conclusion as well, hence
> http://tools.ietf.org/html/draft-josefsson-sasl-tls-cb-00
> which uses the TLS PRF interface.
> 
> For -02 I also added hashing the Finished message, to match the
> semantics for connection/session (regardless of its definition) of
> draft-altman-tls-channel-bindings, but I'd prefer to avoid it
> completely.

I don't agree.  That it's easier to speak of the master secret is not
enough.  The Finished message's construction provides better binding of
the entire negotiation (up to that Finished message), and that's why we
chose it.