# Clarification of RFC2246 with regards to Finished Message

I'm working on a client handshake finished message for a TLS client, and I'm reading through the RFC 2246 spec. The spec states (in section 7.4.9):

The hash contained in finished messages sent by the server incorporate Sender.server; those sent by the client incorporate Sender.client. The value handshake_messages includes all handshake messages starting at client hello up to, but not including, this finished message. This may be different from handshake_messages in Section 7.4.8 because it would include the certificate verify message (if sent). Also, the handshake_messages for the finished message sent by the client will be different from that for the finished message sent by the server, because the one which is sent second will include the prior one.

Is anyone able to clear up what it means in the first sentence with regards to the Sender.server and Sender.client?

• Is there a particular reason for why you are using the TLS 1.0 spec and not the TLS 1.2 spec? Aug 26 '15 at 10:06
• To be honest, I'm pretty sure I had a good reason when I started 2 weeks ago, but I can't remember now. I might try to get things working with 1.0, and then once I have a decent understanding of what I'm doing, upgrade to 1.2 Aug 26 '15 at 10:28

enum { client(0x434C4E54), server(0x53525652) } Sender;

(which are the ASCII strings "CLNT" and "SRVR" respectively) and specified that Sender is included in the hash calculation which in SSLv3 was a concatenation of doubled MD5 and SHA1 keyed hashes. TLSv1.0 changed this to finished_label with the values "client finished" and "server finished", included in the PRF defined elsewhere in the document as the XOR of doubled MD5 and SHA1 HMACs, where each HMAC is itself a doubled keyed hash.