Re: [TLS] Fwd: New Version Notification for draft-ieft-tls-falsestart-00.txt

[Brian Smith <[e-mail]>]

On Thu, May 7, 2015 at 11:25 AM, Martin Thomson <[e-mail]>
wrote:

> If the client certificate is to be enciphered in an immediate
> renegotiation handshake, and both initial and renegotiation use False
> Start, the client should probably check the Finished message on the
> first before completing the renegotiation. Unless there are issues
> delaying the Finished delivery, the client should have that prior to
> when it needs to send the certificate.
>

We should just say that False Start should only be done during the initial
handshake, and MUST NOT be done during renegotiation. Do any
implementations False Start during renegotiation?

Note that you can create a session during the initial TLS handshake and
then resume that session during the renegotiation, so there was already a
way to nearly guarantee a 1-RTT renegotiation handshake with vanilla TLS,
as long as both sides support session resumption. And, if either
implementation is too conservative to implement session resumption, that's
a good hint that they'd rather not do False Start either.

Cheers,
Brian