For DTLS with client authentication, the client is required to send a CertificateVerify message, which has the following structure:

struct {
           digitally-signed struct {
               opaque handshake_messages[handshake_messages_length];
      } CertificateVerify;

According to DTLS specification (RFC 6347 - Section 4.2.6), Finished messages (which also involve taking hash of the concatenation of all handshake messages) does not consider fragmentation of packets:

CertificateVerify and Finished messages have the same format as in TLS. Hash calculations include entire handshake messages, including DTLS-specific fields: message_seq, fragment_offset, and fragment_length. However, in order to remove sensitivity to handshake message fragmentation, the Finished MAC MUST be computed as if each handshake message had been sent as a single fragment.

Is this the case for CertificateVerify as well, that is, does CertificateVerify sign the concatenation of handshake messages considering each message as a single fragment? If not, then is there any specific reason for keeping the two computations different? Implementations should become simpler (lesser storage requirements) if they are the same.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.