TLS handshake message FINISHED contains a PRF computation using master secret over hash of handshake messages exchanged so far. The application data records can flow only after the TLS endpoint has decrypted and subsequently verified the contents of FINISHED message.

What does the verification of PRF computation contained in FINISHED message prove to the peer?

Why being able to decrypt the TLS record containing FINISHED message is not sufficient to be able to start application data exchange?

  • 1
    $\begingroup$ This ensures that nobody has intercepted the handshake messages and modified them. Potential attackers could otherwise downgrade proposed encryption ciphers or MITM DH exchanges. It is the most important step. Being able to decrypt does not guarantee that (as it would be with an attackers chosen parameter) $\endgroup$
    – eckes
    May 5 '17 at 6:28
  • $\begingroup$ Thanks for the answer. In case of extended-master-secret, the master secret derivation is a function of hash of handshake messages. Therefore, being able to generate the same master-secret should sufficiently guarantee that the peer is authentic one and that the handshake has not been tampered by MITM. Does using extended-master-secret obviate need of verifying PRF computation in FINISHED message? $\endgroup$
    – Vakul Garg
    May 5 '17 at 8:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.