Re: [TLS] CCS and key reset and renegotiation

On Thu, Jun 5, 2014 at 6:41 PM, Peter Gutmann <pgut001@cs.auckland.ac.nz> wrote:
> Watson Ladd <watsonbladd@gmail.com> writes:
>
>>The spec needs a state machine.
>
> No, it's this that created the problem in the first place.  SSL/TLS (and SSH,
> and others) are best described using a ladder diagram (and in fact that's how
> pretty much every diagram of the protocols that I've ever seen does them).
> The fact that the spec dresses it up like a state machine means that anyone
> who actually tries to implement it that way ends up vulnerable to mistakes
> like the current OpenSSL one.  So the spec needs to take a protocol that
> exists as a ladder diagram and describe it as such, not pretend that it's
> meant to be a state machine.

Because the Certificate, Certificate Request, ServerKeyExchange, and
some other messages in the handshake are optional, I don't see how a
ladder diagram can encapsulate the protocol. That's ignoring the fact
that you can send as much application data as you desire before
terminating the connection, so there is a branch: either we get app
data, or a termination.

To me a spec based on a state machine says in each state what all the
allowed transitions are, and what is emitted in each state, and what
drives the transitions.

Either way 5 out of 6 implementors got it right. It's not even a
barrier to formalization: what the protocol does is a much bigger
issue, and that's where I hope to send a lengthy email laying out what
TLS 1.3 should look like. (There is also another issue: X509 is
massively complicated and is the only certificate format TLS supports.
Perhaps we should consider lightweight alternatives)

Sincerely,
Watson Ladd

>
> Peter.
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin