[TLS] Summary of discussion regarding spontaneuous authentication

[Martin Thomson <[e-mail]>]

The update proposal that ekr sent around was discussed.

The primary concern was that the properties of the connection were
considered to change with respect to authentication.  Any data
received before the authentication, or messages that appear partially
before and partially after would have ambiguous properties.

Concerns were raised that having the authentication attest to data
that was sent prior to the authentication would expose us to a variety
of attacks that relied on confusion about the state of the connection.
There was also a concern that this would be difficult to analyse.

It was pointed out that update was still interesting, but only from a
rekeying perspective, because that had far lesser risks and no real
API implications.

If we decided to continue with Update, then we would have a place to
add a future extension that re-enabled this feature.

I noted that the use case that renegotiation provides was not going to
be supported with the proposed Update message, since there was no
analogue for the HelloRequest message.

All of this led to the decision not to pursue spontaneous authentication.