[TLS] Use HTTP (Re: Justification)

[Nicolas Williams <[e-mail]>]

On Wed, May 12, 2010 at 05:05:48PM +0200, Simon Josefsson wrote:
> ons 2010-05-12 klockan 07:55 -0700 skrev Michael D'Errico:
> > Can someone please remind me why we want cached-info?  It seems that
> > the problems it creates aren't worth the small optimization it might
> > provide.
> 
> I still have hope we can rescue the extension.  The use-case I have seen
> is that server cert chains and list of trusted CAs can easily make a TLS
> 30-40kb large.  Caching would reduce this.

If we must keep this extension I say:

 - use HTTP to get them and modify the Finished message computation
   modified to include the objects obtained out of band;

 - the URLs would replace the SHA-1/FNV-1a hashes in the protocol.

> However, TLS session resume also solves this problem, and it is
> relatively easy to implement in most libraries.

Yes.

Nico
--