Re: [CHANNEL-BINDING] [TLS] [sasl] Updates to draft-altman-tls-channel-bindings, take two (PLEASE REVIEW)

[Nicolas Williams <[e-mail]>]

On Tue, Mar 23, 2010 at 07:56:19PM +0000, Larry Zhu wrote:
> > It occurs to me that it must be very unlikely that any apps using the
> > MSFT variant of tls-unique are doing authentication after TLS
> > re-negotiation.
> 
> Should we instead say that the receiver/verifier of the tls-unique
> binding is encouraged to remember the previous finished structure
> before re-negotiation. If the synchronization is more than 2 finished
> messages apart, the auth request is expected to fail.

What's the motivation?  Is it really that hard to keep the initial CB
around?  It is tiny...

> This way we have a solution when the actual need arises, without
> complicating either the interface or the protocol. Hopefully the
> burden to implementation is minimal as well. Is that reasonable?

Ah, I think I understand.  In your API it's the application's burden to
remember the CB from the initial handshake.  But even so, that does not
seem like such a tough burden.

Your proposal is more reasonable than the earlier one for the simple
reason that we'll never see three handshakes prior to authentication,
and accepting the possibility of spurious authentication failures in
such cases, if they happened, would be OK with me.

Nico
--