Re: [TLS] Renegotiation: trying to summarize

[Peter Gutmann <[e-mail]>]

Martin Thomson <[e-mail]> writes:

>1. Remove renegotiation entirely
>
>Brian Smith proposed this.  Arguments for are its beautiful simplicity and
>the fact that it ensures that you limit the time that a single session (and
>the corresponding keys) live.

Another argument strongly in favour of removing it is that in all the
applications where I've seen a requirement for renegotiation (e.g. in industry
standards that use TLS), in approximately, oh, 100% of them it was due to some
misguided perception that it'd do... well, no-one could really explain it, but
the capability was there so we may as well add a clause requiring it.

In some cases the requirement was so clearly ridiculous (infrequent reporting
from SCADA systems where you'd need to renegotiate on each message) that
implementers chose to ignore it, but in other cases it wasn't easy to convince
people that it was pointless, particularly when some standards committee had
decided that you had to do it.

I'm strongly in favour of removing it, it's mostly pointless, it's been the
cause of the first real flaw in the SSL/TLS protocol design (rather than an
implementation issue), and it really messes things up when other standards
groups decide they need to mandate it without knowing why.

Peter.