Subject: [TLS] ClientHello1[truncated] - definitions?

From: Hubert Kario <[email-masked]>
Date: Fri, 28 Jul 2017 14:41:01 +0200

(looking at -21)

Section 4.2.10.2 PSK binder refers to ClientHello1[truncated] as the value 
that needs to be used as parameter to Transcript-Hash.

Neither 'truncated' nor 'ClientHello1' are formally defined.

ClientHello1 can be guessed (given text in 4.4.1) as the first ClientHello 
that the client sends. But the value of 'truncated' is an enigma.
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic

---

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 28 Jul 2017 07:45:40 -0500

> that the client sends. But the value of 'truncated' is an enigma.

Just a few paragraphs prior is:

   [...] Each entry in the binders list is computed as an HMAC
   over a transcript hash (see Section 4.4.1
<https://tools.ietf.org/html/draft-ietf-tls-tls13-21#section-4.4.1>) containing a partial
   ClientHello up to and including the PreSharedKeyExtension.identities
   field.  That is, it includes all of the ClientHello but not the
   binders list itself.  The length fields for the message (including
   the overall length, the length of the extensions block, and the
   length of the "pre_shared_key" extension) are all set as if binders
   of the correct lengths were present.

Please say more about how this could be made into a more-formal definition.

-Ben

---

From: Hubert Kario <[email-masked]>
Date: Fri, 28 Jul 2017 15:44:10 +0200

On Friday, 28 July 2017 14:45:40 CEST Benjamin Kaduk wrote:
> <https://tools.ietf.org/html/draft-ietf-tls-tls13-21#section-4.4.1>)
> containing a partial ClientHello up to and including the
> PreSharedKeyExtension.identities field.  That is, it includes all of the
> ClientHello but not the binders list itself.  The length fields for the
> message (including the overall length, the length of the extensions block,
> and the length of the "pre_shared_key" extension) are all set as if binders

something like this:

   ClientHello1 is the initial ClientHello and ClientHello2 is the ClientHello 
   send by client as a response to HelloRetryRequest. For both of those 
   messages, the binder value will be computer over:

     truncated = Handshake.length - length(Extension.extension_data)
     Transcript-Hash(ClientHello1[truncated])

  Given Handshake message that contains the ClientHello message and the
  Extension that contains the PreSharedKeyExtension.

Though the references to specific message and extension could be made 
cleaner...
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic

---

From: Martin Thomson <[email-masked]>
Date: Mon, 31 Jul 2017 10:28:44 +1000

>   Extension that contains the PreSharedKeyExtension.

I think that what you want is

ClientHello1_truncated - ClientHello1.length -
PreSharedKeyExtension.binders.length

And you need to point out that the length of the binders is included, i.e.,

PreSharedKeyExtension.binders.length = 2 +
sum(PreSharedKeyExtension.binders[i].length)

---

From: Hubert Kario <[email-masked]>
Date: Mon, 31 Jul 2017 10:13:44 +0200

> sum(PreSharedKeyExtension.binders[i].length)

aah, yes, on second reading I noticed that identities are not supposed to be 
removed, so yes it's without binders.length, not extension.length.

I went for the generic ClientHello instead of ClientHello1 as it applies both 
to initial and the one that is a response to Hello Retry Request, but the PSK 
extension is the same in both cases so explicit name of it would probably be 
better.

There's a slight problem with the syntax of 
  PreSharedKeyExtension.binders[i]
as [] are used to define a length of a vector, and in that is contrary to the 
meaning of
   ClientHello1[truncated]

I think it would be cleaner to include that "2" in original and explain where 
it comes from rather than defining `length` different ways for the `binders` 
vector and for the  PSKIdentity struct.