Re: [TLS] TLS renegotiation issue

[Martin Rex <mrex at sap.com>]

Nicolas Williams wrote:
> 
> > The MITM can make sure they match.
>
> I should expand on this.
>  [helpful explanantion removed]

Blush -- you are correct.

The MITM can make the two previous sessions come out with the same
client.random and server.random.

So these are not a secure back pointer.

> 
> You can't use the client.random and server.random as channel bindings.

I'm trying to use terminology that is already in the TLS specs.
The generic term "channel bindings" is a little bit to fuzzy for
my taste, and the original use of channel bindings in GSS-API
is not cryptographically secure.

> 
> But the client's Finished message from the outer TLS connection works.

OK.

You win.  ;-)


-Martin