The Transcript

Authenticated Key Share

The TLS shape is not just DH. It is DH with an authenticated server share in the transcript.

highlighted = computed this step

Why bare DH is not enough

Unauthenticated DH can be swapped by a man-in-the-middle. The certificate check makes this toy server share part of the signed transcript.

authenticate the DH share\text{authenticate the DH share}
Authenticated key shareToy TLS transcript table recomputed from DH and RSA pins.Authenticated key share - hash=43itemvaluecheckClientHello4pinnedServerHello9pinnedCertificate digest33root signatureServerKeyShare19DH publicClientKeyShare8DH publicTranscript hash43weighted mod 97Shared secret2DH recomputeClient Finished64toy checkServer Finished70toy check

Recompute the shared secret

Using client secret 6 and server secret 15, both sides reach shared secret 2.

196 mod 23=219^{6}\bmod 23=2
Authenticated key shareToy TLS transcript table recomputed from DH and RSA pins.Authenticated key share - hash=43itemvaluecheckClientHello4pinnedServerHello9pinnedCertificate digest33root signatureServerKeyShare19DH publicClientKeyShare8DH publicTranscript hash43weighted mod 97Shared secret2DH recomputeClient Finished64toy checkServer Finished70toy check

What the signature prevents here

If an attacker changes server share 19, the digest and signature check no longer match this toy certificate.

changed share⇒bad signature\text{changed share}\Rightarrow\text{bad signature}
Authenticated key shareToy TLS transcript table recomputed from DH and RSA pins.Authenticated key share - hash=43itemvaluecheckClientHello4pinnedServerHello9pinnedCertificate digest33root signatureServerKeyShare19DH publicClientKeyShare8DH publicTranscript hash43weighted mod 97Shared secret2DH recomputeClient Finished64toy checkServer Finished70toy check

Summary

The toy transcript authenticates the server DH share before Finished is checked. NOTE: toy-modulus; no-padding; no-side-channel; no-production; never-roll-your-own. Toy transcript only: not real TLS bytes, not real certificate validation, no AEAD record protection, and no security-size claims.

signed share before Finished\text{signed share before Finished}
Authenticated key shareToy TLS transcript table recomputed from DH and RSA pins.Authenticated key share - hash=43itemvaluecheckClientHello4pinnedServerHello9pinnedCertificate digest33root signatureServerKeyShare19DH publicClientKeyShare8DH publicTranscript hash43weighted mod 97Shared secret2DH recomputeClient Finished64toy checkServer Finished70toy check