Re: [TLS] [CHANNEL-BINDING] RESOLVED (Re: [sasl] lasgt call comments (st Call:

[Nicolas Williams <[e-mail]>]

On Mon, Nov 02, 2009 at 05:48:44PM +0100, Martin Rex wrote:
> And btw. Channel Binding at the application layer and
> transparent TLS-session renegotiation at the TLS layer appear
> somewhere between hard-to-do and mutually exclusive--in case
> that the TLS session renegotiation happens totally transparent
> to the application.

In order to do channel binding to TLS channels you MUST have some sort
of interface to TLS, and that interface MUST let you get at, in this
case, the first Finished message (in cleartext) sent by the client.

Such an interface necessarily implies that TLS can't be entirely
transparent to the application, though some aspects of TLS well might
be.

Session resumption and re-negotiation complicate how we identify that
one message, but they hardly make it impossible.  It gets more
complicated if a protocol were to multiplex multiple unrelated TLS
connections on one TCP/SCTP connection/association.   But it's still not
impossible: the application, after all, would be keeping track of the
various streams and keeping them logically separate.

In spite of the _text_ that we need to describe tls-unique being
complicated by session resumption and re-negotiation, the actual
interfaces and source code will be simple.  The complexity is primarily
the result of not having a handy word in the TLS terminology for what
the Microsoft SSPI interface to TLS calls "security context".  If TLS
did define such a term, then it'd be easier to specify tls-unique.

So far I see no real objections to the actual proposal.  Larry objected
that the text might make an implementor think that TLS channel bindings
are associated with TCP connections.  You and Simon would prefer to
speak of the Master secret because that doesn't change when you
re-negotiate -- but that's hardly enough to change gears now, and then
you'd have to bind in things that the Master secret doesn't bind (which
would correspondingly complicate your alternative).

Let's keep things simple.  Please review the proposed text.

Nico
--