themighty1/tlsnotary — pull request #15 by AdamISZ (2014-07-25 20:05:13+00:00)
Title: Ssl modular

Encapsulation of ssl client session tlsnotary-style in a python class in shared/tlsn_crypto.py (TLSNSSLClientSession).

This moves almost all of the TLS logic out of the main script, and removes some repetitions of TLS logic in that code.

It provides for some considerable simplification of further amendments - for example, the blanking out of certain keys from the hmac (see parameter 'garbage' in setPValueMS()), and isolates the key expansion process in one place (see doKeyExpansion()). Implementing new modes (such as modes where the server encryption key is withheld) become easier. The dump() function shows the entire state of the session which is useful for debugging.

It should also make it a lot easier to achieve the potential future version in which the TLSNotary ssl session occurs entirely outside of the browser/NSS. The biggest obstacle to that right now seems to be the certificate extraction and the verify data.