Re: [TLS] Abbreviated Handshake != Renegotiated Handshake

[Ravi Ganesan <[e-mail]>]

> The HelloRequest handshake message does not carry an indicators
> why a server requests renegotiation, so a client can only guess.
> The most commonly known usage in popular applications on
> the internet seems the request for a client certificate after
> having seen the clients request.
>

Sure, and in this case if the Client responds with a Client Hello with the
initial session ID then the server has to anyway respond with a full
handshake server-hello (else it cannot get client-auth).

My only point is that we are relying on app that requests a "renegotiate" of
its underlying SSL stack to differentiate between two cases: (i) where the
renegotiate with full handshake really happens and (ii) when a previous
session is resumed. If there is no need for case (ii) it seemed to me to be
better to not let this happen, and hope the app can tell the difference.

Sounds like everyone else thinks this is fine -- so be it.

Cheers,

Ravi