Re: [TLS] matching identity, by default

[Marsh Ray <[e-mail]>]

David-Sarah Hopwood wrote:
> Marsh Ray wrote:
>> * The TLS protocol allows application data to be interleaved within
>> rengotiation handshake messages. Sometimes this is desired, but may
>> require extra care. The application-supplied callback and TLS library
>> normally SHOULD discard any buffered plaintext at the point of
>> renegotiation.
> 
> I appreciate the problem that this recommendation is trying to solve,
> but as stated here it may do more harm than good. Discarding any plaintext
> may cause the application protocol states at the client and server to
> lose synchronization, creating a vulnerability, or at least incorrect
> behaviour.

Good point. It certainly "requires extra care".

Ideally the app layer would be defined to discard all state and buffered
data at the point of renegotiation, too.

- Marsh