Re: [TLS] Triple Handshake Fix.

[Nico Williams <[e-mail]>]

On Mon, May 5, 2014 at 3:44 PM, Bodo Moeller <[e-mail]> wrote:
> Nico Williams <[e-mail]>:
>
>> (2) only results in reduced performance in old/new or new/old cases,
>> but those should disappear soon enough.
>
>
> The point is, if you're the first to switch from "old" to "new", this would
> affect *all* your connections.  (Indeed there's no interoperability problem
> per se, but the performance hit can be nontrivial.)  Having (1) available as
> an intermediate state would make it easier to switch early.

Several optimizations are possible.  Here's a possible set of rules:

 - neither new clients nor new servers should permit renegotiation
within resumed connections when talking to an old peer

 - new clients should not permit resumption of renegotiated
connections to old servers unless the inner connection is bound to the
outer and

   - tls-unique will not be extracted or will be made unavailable when
talking to old servers

 - new servers should not offer nor permit resumption by old clients
when tls-unique CB may be extracted OR they should disallow tls-unique
CB extraction

Is that complete?  I think so.  But that's fairly complicated and
mistakes could be made in interpreting it.

We all need resumption fixed, and we're getting pretty good at
deploying new TLS implementations (because goto fail bug, because
heartbleed).  I'd rather simplify things by going with (2) alone.

Nico
--