Re: [TLS] draft-ietf-tls-session-hash-04 and session resumption

Personally, I dislike unnecessary wiggle room in specs and mildly prefer
MUST. I don't see a good reason to abort rather than do a full handshake.
It'd be nice to have the confidence that (non-buggy) servers won't cause
problems here and take a shortcut. (E.g., I can see aborting being simpler
in OpenSSL since it parses most extensions after session resumption is
resolved. The ticket is handled special.)

Then again, one might read MUST to imply the server is obligated to perform
a full handshake and isn't allowed to abort for other reasons, which would
be poor.

On Wed, Apr 15, 2015 at 3:38 AM Karthikeyan Bhargavan <
karthik.bhargavan@gmail.com> wrote:

> I guess my question is whether “SHOULD perform a full handshake” is strong
> enough,
> leaving the server the option of aborting the handshake, or is MUST
> preferable
> as a clearer indication to implementers?
>
>
> On 15 Apr 2015, at 08:15, Karthikeyan Bhargavan <
> karthik.bhargavan@gmail.com> wrote:
>
> > I like Martin’s text, and have edited it to the following:
> >
> >    If the original session did not use an extended master secret but
> >    the new ClientHello does contain the "extended_master_secret"
> >    extension, the server MUST NOT continue the abbreviated handshake.
> >    Instead, it SHOULD perform a full handshake to negotiate a new
> session.
> >
> > If this looks acceptable, I’ll put out a new version of the draft today.
> >
> > -K.
> >
> > On 15 Apr 2015, at 03:53, Martin Rex <mrex@sap.com> wrote:
> >
> >> Karthikeyan Bhargavan wrote:
> >>> How about the following:
> >>>     If the original session did not use an extended master secret but
> >>>     the new ClientHello does contain the "extended_master_secret"
> >>>     extension, the server MUST fall back to a full handshake by
> >>>     sending a ServerHello that rejects session resumption and offers a
> >>>     new session.
> >>
> >> Too complicated for my taste.  I do not see a need for words like
> >> fallback and reject, and these actually do not exist in the TLS
> protocol.
> >>
> >>
> >>    If the original session did not use an extended master secret but
> >>    the new ClientHello does contain the "extended_master_secret"
> >>    extension, the server MUST perform a full handshake to negotiate
> >>    a new session (i.e. the server MUST NOT perform an abbreviated
> >>    handshake aka session resume).
> >>
> >>
> >> -Martin
> >
> > _______________________________________________
> > TLS mailing list
> > TLS@ietf.org
> > https://www.ietf.org/mailman/listinfo/tls
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>