Re: [TLS] Proposal for hybrid solution using most of the ideas

[Yoav Nir <ynir at checkpoint.com>]

On Nov 19, 2009, at 10:10 AM, Stefan Santesson wrote:
> 
> I disagree.
> 
> I think we agree that an upgraded finished calculation is not a dirty hack.
> This is what future versions of TLS will use by default.
> 
> Remains then the signaling C->S and S->C client.
> 
> The RI proposal also includes the use of a magic cipher suite, so that dirty
> hack is in both proposals.
> 
> Which leaves us with S->C signaling. Here I'm not sure we have exhausted all
> options.

I've got one more.  

Change the Finished message calculation to include the old verify_data.  That's in all proposals.

I would add to that to also change the Finished message calculation in the initial negotiation, and use a single zero byte for the old verify_data, but do this for the client only.

That way, the client can attempt to calculate the Finished message in both the old and new way, and recognize if the server is patched or not.

I realize this is less than optimal, because in the normal handshake, the client's ChangeCipherSpec and Finished message precede the server's, so we can't alter the client's Finished message in the same way without breaking connectivity with un-patched servers.