I am trying to build an EAP-TLS client. The handshake I have to deal with involves receipt of fragmented messages from the RADIUS server. As a part of the client reply, I have to construct a certificate verify message, which involves hashing all messages involved in the handshake using a private key, to ensure mutual authentication. So, do I treat the fragmented messages as separate messages (because each fragment has an Ethernet header appended to it) or as a single message? Thanks !
In TLS, the handshake messages are encoded into records. Each record has its own header. A given handshake message may be spread over several records, and a record may contain several handshake messages.
The hash computations for
Finished messages is over the handshake messages only: you input the successive handshake messages into the hash function, in due order; each handshake message begins with a four-byte header (one byte for the message type, three bytes for the handshake message length), and these headers go to the hash function as well. The record headers do not enter the hash function.
In other words, fragmentation into records is ignored in the hash computations. The resulting hash value does not depend on how the handshake messages where conveyed, in particular any kind of fragmentation. EAP/TLS defines that the EAP messages contain TLS records. Neither the Ethernet headers, the EAP packet headers, or even the TLS record headers, enter the hash function. Only the handshake message themselves are hashed.
(This allows for a cleanly layered implementation: the SSL/TLS library produces handshake messages which are sent one after the other on a conceptual endless stream of bytes; the stream is hashed; the library does not have to care about how the stream is split into records encapsulated into EAP messages fragmented into individual Ethernet frames.)