Re: [TLS] Proposed text for removing renegotiation

[Daniel Kahn Gillmor <[e-mail]>]

On 06/17/2014 03:36 AM, Nikos Mavrogiannopoulos wrote:
> On Fri, 2014-06-13 at 08:34 -0300, Watson Ladd wrote:
> 
>> The issue is the following: most applications do something like this
>> parse_request(conn)
>> check_if_request_authorized(conn)
>>
>> This assumes that the authentication state doesn't change in between
>> the two lines, or midway through the parse.
>> With renegotiation it can.
> 
> Indeed, but this is an easily unsolvable issue. 

Do you mean "easily solvable" here?

> That can be easily
> avoided on the implementation side (and gnutls is does not allow that).
> I have numerous times asked to clarify and better specify this part on
> the past.

Do you have a suggestion for how we could clarify and better specify
this part?  Maybe it's worth crafting that into a counterproposal that
could be weighed against the current "remove renegotiation" proposal.

I realize that we frequently claim we "don't do API" here, and the issue
of how well application developers actually deal with connection
property changes comes close to the API of any given TLS implementation.

But I suspect most application developers who use TLS don't understand
that the authentication state or cryptographic protections of the
connection may change mid-stream.  Of the minority that does understand
that this state may change, i suspect that many of them don't actually
handle the situation well (if at all).

if we want to avoid this on the implementation side, do we need more
guidance to implementers of TLS stacks?  or guidance for
application-layer users of those stacks?  or both?

	--dkg