# Authentication in TLS protocol

TLS session keys are derived as a result of authenticated key agreement.

Is being able to decrypt a record at an endpoint after receiving change_cipher_spec sufficient guarantee that the endpoint is accepting record from the authenticated peer? I believe 'yes'.

I understand that the verification of TLS finished message ensures that the handshake messages were not tampered by MITM. The decryption of TLS record containing finished message proves the record arrived from authenticated peer.

In the case of extended-master-secret extension, the master secret (and hence session keys too) are derived as a function hash of handshake message (i.e. transcript hash). Therefore, if extended master secret is used, being able to decrypt records after change_cipher_spec should prove both authenticity of peer & non-tampering of handshake messages.

In this case, can the handshake protocol do away with finished message without compromising on the security guarantees?

• It would make the formal analysis of the handshake even more of a nightmare than it already is, because you then lose modularity and composability guarantees and thelike. – SEJPM May 8 '17 at 20:55
• Also note that finished authenticates the transcript (and especially all parts of the handshake that weren't part of the actual key derivation process). – SEJPM May 8 '17 at 21:40
• We may be a bit reluctant to answer this as Dave is around... :) – Maarten Bodewes May 8 '17 at 22:01
• Regarding transcript authentication, doesn't it gets indirectly achieved since transcript hash was used to generate extended master secret? Can you kindly elaborate? – Vakul Garg May 9 '17 at 1:30

An odd situation is where you would send a byte valued 00 or 01 if a condition is true and nothing if a condition is false. In the false case no data record needs to be send: but that means that the handshake is never verified!