Re: [TLS] Proposed text for removing renegotiation

Daniel Kahn Gillmor <> Tue, 17 June 2014 20:56 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id CEF5F1A0168 for <>; Tue, 17 Jun 2014 13:56:51 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id QikXsDfsDgAV for <>; Tue, 17 Jun 2014 13:56:49 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 78E221A0154 for <>; Tue, 17 Jun 2014 13:56:49 -0700 (PDT)
Received: from [] (unknown []) by (Postfix) with ESMTPSA id E6FDDF984; Tue, 17 Jun 2014 16:56:43 -0400 (EDT)
Message-ID: <>
Date: Tue, 17 Jun 2014 16:56:30 -0400
From: Daniel Kahn Gillmor <>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101 Icedove/30.0
MIME-Version: 1.0
To: Nikos Mavrogiannopoulos <>, Watson Ladd <>
References: <> <> <> <> <> <> <> <> <> <> <> <> <>
In-Reply-To: <>
X-Enigmail-Version: 1.6+git0.20140323
Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="76GctuBcn9eD0q0UO5LDmT2f6SSjmiaF7"
Cc: "" <>
Subject: Re: [TLS] Proposed text for removing renegotiation
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 17 Jun 2014 20:56:52 -0000

On 06/17/2014 03:36 AM, Nikos Mavrogiannopoulos wrote:
> On Fri, 2014-06-13 at 08:34 -0300, Watson Ladd wrote:
>> The issue is the following: most applications do something like this
>> parse_request(conn)
>> check_if_request_authorized(conn)
>> This assumes that the authentication state doesn't change in between
>> the two lines, or midway through the parse.
>> With renegotiation it can.
> Indeed, but this is an easily unsolvable issue. 

Do you mean "easily solvable" here?

> That can be easily
> avoided on the implementation side (and gnutls is does not allow that).
> I have numerous times asked to clarify and better specify this part on
> the past.

Do you have a suggestion for how we could clarify and better specify
this part?  Maybe it's worth crafting that into a counterproposal that
could be weighed against the current "remove renegotiation" proposal.

I realize that we frequently claim we "don't do API" here, and the issue
of how well application developers actually deal with connection
property changes comes close to the API of any given TLS implementation.

But I suspect most application developers who use TLS don't understand
that the authentication state or cryptographic protections of the
connection may change mid-stream.  Of the minority that does understand
that this state may change, i suspect that many of them don't actually
handle the situation well (if at all).

if we want to avoid this on the implementation side, do we need more
guidance to implementers of TLS stacks?  or guidance for
application-layer users of those stacks?  or both?