Re: [TLS] Wrapping up cached info

[Nicolas Williams <[e-mail]>]

On Mon, May 17, 2010 at 03:58:08PM +0200, Stefan Santesson wrote:
> I will not lead an effort to specify a variant of this protocol where the
> server provides the identifiers, either as any random identifier or in the
> form of a URI. If that is the desire of the WG, I will be happy to hand over
> editorship to anyone, assigned by the chairs, who wants to take over.

I don't care how the cached objects are identified.

It's not clear to me either how collisions in the cached object
checksums can be exploited, but it is clear that the security analysis
of the protocol is much simpler if you bind the cached objects into the
handshake.  Which is why I strongly encourage you to add such a binding
to the protocol.  I may well be alone in this, in which case I'd settle
for a requirement that one be able to disable caching in all
implementations.

If the WG agrees to proceed without adding such a binding, then I'd also
like to see a detailed analysis of possible attacks and why they either
cannot happen or are of no value to the attacker.

Nico
--