Subject: [TLS] Draft-22 and Post-Handshake Authentication

From: "Short, Todd" <[email-masked]>
Date: Tue, 2 Jan 2018 17:06:59 +0000

Question on Post-Handshake Authentication (PHA):

PHA can occur multiple times over a connection. The description for the "Handshake Context” is as follows (4.4):

   |           |                            |                          |
   | Post-     | ClientHello ... client     | client_application_traff |
   | Handshake | Finished +                 | ic_secret_N              |
   |           | CertificateRequest         |                          |
   +-----------+----------------------------+--------------------------+

Now, PHA costs of:

S>C: CertificateRequest

followed by:

C>S: Certificate+CertificateVerify+client Finished

This could be interpreted to mean that these PHA messages are included in the Handshake Context. However, Section 4.4.1 states:

   For concreteness, the transcript hash is always taken from the
   following sequence of handshake messages, starting at the first
   ClientHello and including only those messages that were sent:
   ClientHello, HelloRetryRequest, ClientHello, ServerHello,
   EncryptedExtensions, server CertificateRequest, server Certificate,

   server CertificateVerify, server Finished, EndOfEarlyData, client
   Certificate, client CertificateVerify, client Finished.

I want to confirm that the PHA handshake context consists only of the messages listed in section 4.4.1 from the initial handshake, and do not include any of the messages from intermediate PHA exchanges.

Thank you,

--
-Todd Short
// [email-masked]<mailto:[email-masked]>
// "One if by land, two if by sea, three if by the Internet."

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 2 Jan 2018 09:22:50 -0800

Yes, that is correct

On Tue, Jan 2, 2018 at 9:06 AM, Short, Todd <[email-masked]> wrote:

> This could be interpreted to mean that these PHA messages are included in
> the Handshake Context. However, Section 4.4.1 states:
>
> I want to confirm that the PHA handshake context consists only of the
> messages listed in section 4.4.1 from the initial handshake, and do not
> include any of the messages from intermediate PHA exchanges.
>
> Thank you,
>
> --
> -Todd Short
> // [email-masked]
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>
>