Re: [TLS] Proposal for hybrid solution using most of the ideas

[Martin Rex <mrex at sap.com>]

Dr Stephen Henson wrote:
> 
> Martin Rex wrote:
> > 
> > 
> >> Yes, we might be missing something else. The reason I picked the Certificate
> >> message is that it is dynamic size by default, so we don't have to alter
> >> existing data, just append.
> > 
> > To me that feels very wrong to use the Certificate message.
> > I'm convinced that it should go into the ServerHello.  I'm not
> > questioning that ServerHello is the correct place for all of the
> > cryptographic parameters _and_ the TLS extensions.
> > 
> 
> Well in terms of implementation and overhead I'd prefer that the client
> knows as soon as possible which method to use. The need to maintain two
> hash contexts (or cache some potentially long handshake messages) and
> always throwing one away is IMHO not trivial.

This is why I favour the approach with adding the verify_data
of the finished messages directly after ServerHello,
because that is where the "negotiation"/signaling is completed
both peers can determine how to proceed,  no assumptions
necessary, no keeping multiple hashes around.

-Martin