Re: [TLS] Re: when is it ok to resume a cached SSL/TLS session

> Peter,
>
> TLS session IDs do not come with any guarantee that the 
> server will
> actually honor a resumption request. The server may 
> implement any
> session cache policy it chooses. Therefore the client 
> *must* be
> prepared for the server to refuse resumption.
>
> -Ekr

So the only thing we are disagreeing on is the definition of 
"must be prepared".

You say choked, I say graceful fail.

So... we are back to the reasserting the old adage: the TLS 
standard DOES NOT constrain or recommend on how TLS 
Transport connections are handled in general. The words in 
TLS could not be much clearer. https is of course both an 
application and a "usage model" for TLS, some SSL-related 
parts of which folks have attempted to create a standard 
profile as regard alert handling.

I fail to see why the UI behavior of a multi-URL-protocol 
browser should be different for https vs other URL 
protocols. Furthermore, a non-Navigator-style web client is 
even less constrained, because it may a moniker resolver 
aswell as a URL resolver built into the application. We all 
know wininet has different https behavior to IE, which is 
yet different to the MSN Explorer. We all know Navigator in 
turn has "unique" security semantics concerning its SSL 
session duplication , and a "unique" trust access model to 
cookies by child windows etc... I have no expectation that 
navigator's client-side sessionid caching policy (for https 
resolution) is the same of the other 3 examples, I gave!

If the particular browser experience design has established 
(via a combined security vs usability tradeoff analysis) a 
certain practice concerning how it visualizes and handles 
(connection) failure cases (cannot "connect" to a resource, 
ultimately) when using all the NON-https URL protocols why 
should it vary this view ...for the session resumption 
exception on the https URL?

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls