Isn't this great? I can put myself "in the room" when they decided not to do a full transcript MAC. The SSL3 transcript hash is annoying! It was the first protocol I personally encountered that did that. And what are you trying to protect? A key exchange, right? Why not just create a mechanism that catches the inputs to the key exchange, authenticates them, and ignores everything else? Everything else is just a vehicle for communicating those inputs.
So like, you could imagine yourself looking at the SSL 3.0 "Finished" message and the SSH "Exchange Hash" and asking yourself, why do the complicated thing? The SSH thing seems to work!
And: if you asked yourself that, like, in 2013, you could go on believing for ten years that everything was fine, and SSH just found a clever way to do handshake integrity less cumbersomely than SSL 3.0.
There's like an obvious lesson here about PGP and the MDC, right?
So like, you could imagine yourself looking at the SSL 3.0 "Finished" message and the SSH "Exchange Hash" and asking yourself, why do the complicated thing? The SSH thing seems to work!
And: if you asked yourself that, like, in 2013, you could go on believing for ten years that everything was fine, and SSH just found a clever way to do handshake integrity less cumbersomely than SSL 3.0.
There's like an obvious lesson here about PGP and the MDC, right?