The https://www.rfc-editor.org/rfc/rfc5246#section-7.4.9 states which messages are included for PRF computation that is included in Finished
messages
It is clear for 'regular' (initial) handshake
But assume that the client wants to resume the DTLS session
Client sends the ClientHello
with previous SessionID
field
The server responds with ServerHello
, sends ChangeCipherSpec
(not included for verify_data
computation) and Finished
Which messages should be included for verify_data
field computation in Finished
message sent from server?
A. Should it be only the most recent (resuming) ClientHello
and ServerHello
B. Should it be the most recent (resuming) ClientHello
and ServerHello
plus previous (initial in our example) handshake messages?