On Mon, Aug 8, 2022 at 4:19 PM Dmitry Belyavsky wrote: > RFC 8446 refers to "completed handshake" as a prerequisite for some messages. But looking for the word "completed", I don't see any definition.
On Mon, 8 Aug 2022 at 15:21, Töma Gavrichenkov wrote: > "Upon receiving the server's messages, the client responds with its Authentication messages, namely Certificate and CertificateVerify (if requested), and Finished. At this point, the handshake is complete" I stumbled with this. OpenJDK reports handshake completion twice [1,2]. Anthony Scarpino explains: "SSLEngine with post handshake messages returns HandshakeStatus.FINISHED [more than once]...Before TLS 1.3 and PostHandshake messages, the usage for FINISHED was clearly only during the handshake process and more tied to the [TLS] Finished message [Since TLS 1.3,] KeyUpdate and NewSessionTicket call finishPostHandshake() which sets the handshake status" [3]. The specification would benefit from some extra clarification. [1] https://mail.openjdk.org/pipermail/security-dev/2022-May/030784.html [2] https://mail.openjdk.org/pipermail/security-dev/2022-June/031019.html [3] https://mail.openjdk.org/pipermail/security-dev/2022-June/031044.html
_______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
