Re: [TLS] Proposed text for removing renegotiation

[Brian Sniffen <[e-mail]>]

"Salz, Rich" <[e-mail]> writes:

> Yes, you understand it.  Yes, the trade-offs are like you describe. I happen to think it's cleaner and less likely to have security issues, but we certainly need more discussions. 

One extra trade-off: apps that abstract over sockets and an assumption
they're "secure" will tend to assume a binding between these two TLS
sessions that isn't justified.  If it only happened on very long
sessions, maybe it wouldn't matter in practice---but I expect the case of a
hot-pluggable authenticator to matter.

Airman Smith plugs in his CAC and authenticates to a web server using
the embedded PKCS#11 authenticator.  An hour later, he pulls the CAC and
walks over to the coffeepot.  His browser sees the CAC missing and
issues a CCS.  Five minutes later, Airman Jones inserts her CAC, causing
another CCS.  The browser state is unchanged---cookies persist.

I'd like to avoid encouraging the origin app to mistake this for one
session.

-Brian

-- 
Brian Sniffen
Information Security
Akamai Technologies