Re: [TLS] Resuming a session as part of a renegotiation.

[Yoav Nir <[e-mail]>]

On Sep 19, 2013, at 9:29 PM, Fabrice Gautier <[e-mail]> wrote:
>> One possible use case: if you negotiated a block cipher with a
>> small internal state and are sending large quantities of data,
>> security might be improved by periodically renegotiating.
> 
> Thats only benefit a full handshake renegotiation.
> 
> The way I understand it, renegotiation allows you to have several
> session in the same connection, and session resumption allows you to
> have the same session across multiple connections.

Renegotiation just means doing the handshake again. The end result is new keys. So if you believe that 3DES keys should not be used for more than 0.5GB of data, just doing a renegotiation gives you fresh keys (because they are mixed with the new nonces). If you resume the session, you don't get new client and/or server identities, you don't get re-authentication, and you don't get a new master key, so someone who has managed to get your old master key can figure out both your old and new encryption keys. But if the only reason you're renegotiating is that you need fresh keys, that's good enough.

So renegotiation+resumption gives you the same session, but new keys. Sort of like "phase II" in IKE.

Yoav