Re: [TLS] Call for Consensus on removal of renegotiation

Martin Thomson <martin.thomson@gmail.com> Thu, 26 June 2014 02:01 UTC

Return-Path: <martin.thomson@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B5E41B291A for <tls@ietfa.amsl.com>; Wed, 25 Jun 2014 19:01:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xUs5bIgVn0uF for <tls@ietfa.amsl.com>; Wed, 25 Jun 2014 19:01:20 -0700 (PDT)
Received: from mail-we0-x22f.google.com (mail-we0-x22f.google.com [IPv6:2a00:1450:400c:c03::22f]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A722C1B2EEA for <tls@ietf.org>; Wed, 25 Jun 2014 19:01:19 -0700 (PDT)
Received: by mail-we0-f175.google.com with SMTP id k48so2964765wev.20 for <tls@ietf.org>; Wed, 25 Jun 2014 19:01:18 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=TV2Zf5zTMqWuWG+9ivLXURp1OsG8TZTf0a7ZTmgQebg=; b=QLmQHXcp9psBwwd/S3FlwTSCeIemgzkkbxb65lXWMZS3xMQG682t+o5EhGelaKHbrt wq6+Pw9Og/va4ya61UI/FS6HWLL13PsJNLeBlmCY4DruMb5UNJEVjc9wYj4EisygRA2Z XT2SB0GQOrr1y7atEsuCjVgYm4mPiLiSzIzx1/LYeWSBryE849ML9imeaKJPXQV2KlCl apfpPKSx9613yIYAsnxWAbJqytmnevRx3jj5X2Qxu/Olfr8ginHUxnNXxKlMP5waPTET Yw+QlexWKWZ1sWwt8v9ue7mA0jC/UUJnfrj3pY9h/Y2KMOzsA81cRYicNk/sC3tGgUqV N4Ow==
MIME-Version: 1.0
X-Received: by 10.180.76.132 with SMTP id k4mr633170wiw.1.1403748077948; Wed, 25 Jun 2014 19:01:17 -0700 (PDT)
Received: by 10.194.51.134 with HTTP; Wed, 25 Jun 2014 19:01:17 -0700 (PDT)
In-Reply-To: <2A0EFB9C05D0164E98F19BB0AF3708C71854BEF1FD@USMBX1.msg.corp.akamai.com>
References: <44DA5A30-015D-40F3-90CA-F15076891BBC@cisco.com> <53AB192F.2040001@fifthhorseman.net> <CAAF6GDdkkuB=Eko55vqaPS9Krc0XmiQk0vo2c_q5n6kydpkYuQ@mail.gmail.com> <B18B3440-8CBF-4B04-B792-F81FBF0CE8AC@gmail.com> <2A0EFB9C05D0164E98F19BB0AF3708C71854BEF192@USMBX1.msg.corp.akamai.com> <6B247363-E6E2-4A81-92D8-FE2F02C14227@gmail.com> <2A0EFB9C05D0164E98F19BB0AF3708C71854BEF1A5@USMBX1.msg.corp.akamai.com> <CABkgnnX=m8MVyE7pgLtW16T8Zsy-eXXOiR5JSAq07jpShVjzBQ@mail.gmail.com> <2A0EFB9C05D0164E98F19BB0AF3708C71854BEF1FD@USMBX1.msg.corp.akamai.com>
Date: Wed, 25 Jun 2014 19:01:17 -0700
Message-ID: <CABkgnnUxkRGGz7c47_DW4+uYq7QoQ3sMHWCbPatApPwVtPWGGg@mail.gmail.com>
From: Martin Thomson <martin.thomson@gmail.com>
To: "Salz, Rich" <rsalz@akamai.com>
Content-Type: text/plain; charset="UTF-8"
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/9m2Y36xq_jZTFF9-G9i3AQ_1zow
Cc: "<tls@ietf.org>" <tls@ietf.org>
Subject: Re: [TLS] Call for Consensus on removal of renegotiation
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 26 Jun 2014 02:01:21 -0000

On 25 June 2014 18:57, Salz, Rich <rsalz@akamai.com> wrote:
> The web is more than HTTP; tls-care is global, http-cant is for some small part of the web :)

That's true, but the key point of this is that the application
protocol needs a signal to cause a new connection to be created.  So
far, HTTP is the only application protocol that needs this; hence
-cant.

My point regarding -cant was that it can work without a TLS extension,
i.e., it works if the CertificateRequest is triggered on renego (<=
1.2) or clients can unilaterally authenticate (>= 1.3).