Re: [TLS] Call for Consensus on removal of renegotiation

[Yoav Nir <[e-mail]>]

On Jun 27, 2014, at 1:18 AM, Tapio Sokura <[e-mail]> wrote:

> On 25.6.2014 23:03, Joseph Salowey (jsalowey) wrote:
>> [Joe] to simplify:
>> 
>> 1.  In favor of removing renegotiation
>> 2.  In favor of removing renegotiation with the addition of rekey facility
>> 3.  Not in favor of removing renegotiation 
> 
> I would choose 1 or 2. I wonder how many real-life usage scenarios
> actually move enough data and/or over long enough time to need rekeying
> for real cryptographic reasons.

Depends on what you mean by “cryptographic reasons”. As we’ve seen with other messages on this list, with AES-GCM you’re fine to use the same key for 2^64 or 2^48 records or packets. Either is a huge amount, and I don’t think we have scenarios that need that much data in a single session.

There is another reason, that I don’t know if you’d call “cryptographic” to rekey. It’s similar to forward secrecy. If you have a session that runs for days on the same key, an attacker can record the session, then use some out of band means (like a warrant) to force one side to hand over the key. Deleting the crypto key every hour or so helps here.

Yoav