Re: [TLS] Need for S->C signaling

[Marsh Ray <marsh at extendedsubset.com>]

Yoav Nir wrote:
> 
> But even if the server did send the CCS and Finished message, the
> Finished message does not check out,
> so the client does not complete the request. So where's the damage.
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
http://tools.ietf.org/html/rfc4346
    Client                                               Server

      ClientHello                  -------->
                                                      ServerHello
                                                     Certificate*
                                               ServerKeyExchange*
                                              CertificateRequest*
                                   <--------      ServerHelloDone
      Certificate*
      ClientKeyExchange
      CertificateVerify*
      [ChangeCipherSpec]
      Finished                     -------->
                                               [ChangeCipherSpec]
                                   <--------             Finished
      Application Data             <------->     Application Data

             Fig. 1. Message flow for a full handshake


The client has to send his Finished message before he sees the server's.

The server executes the request when he receives Finished from the
client. There is nothing later he can wait for, really.

MitM can drop the server's Finished message before the client gets a
chance to verify it.

- Marsh