tlswg/tls13-spec — pull request #100 by agl (2014-12-01 22:26:13+00:00)
Title: Specify padding and context strings for signatures

The TLS 1.2 ServerKeyExchange signature never included enough context
and it was possible to lift a signature for one ciphersuite into a
handshake for a different one. TLS 1.2 only avoided signature
repurposing attacks because of luck[1].

Additionally, TLS 1.2 allows an attacker to obtain a signature of a
message with a chosen, 32-byte prefix.

Because of this, this change causes TLS 1.3 to include 64 bytes of
padding at the begining of signed messages in order to easily clear the
chosen-prefix and also context strings to ensure that signatures cannot
be repurposed.

For more context, see
https://www.ietf.org/mail-archive/web/tls/current/msg14734.html

[1] https://www.cosic.esat.kuleuven.be/publications/article-2216.pdf