[TLS] renego, patricide, putting out to stud, etc.

[Ravi Ganesan <[e-mail]>]

>> Ravi Ganesan wrote:
>> ii) A node can create a child node by performing renegotiation, followed by
>> a full handshake. Such a full-renego-child, starts afresh with new values
>> for all of the first five parameters. The only parameter which keeps it tied
>> to this tree is the renegotiation-information, which is derived from the
>> handshake and the parent-node's renegotiation-information. The primary
>> use-case for this technique is  to update authentication-knowledge of the
>> Server (i.e. does it know who the Client is?).  The creation of such a child
>> node means the parent node can no longer be used.

>That (the last sentence) is not the case, as far as I'm aware. Renegotiating
>on some connection currently associated with a session does not mean that
>that session can no longer be resumed.

>David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com

What I meant by 'that node can no longer be used', is that since the
effective encryption/hashing keys have been rolled over,
trying to send data using the values in that node to the side should
not work. In that sense either of the renego child nodes renders its
parent inactive.
It did occur to me that the node while it cannot be 'used' (per my
def) might still be able to have progeny (put out to stud if you
will!).
I just figured that one could get an identical result by using the
parameters in the child to do the "resume", and that would be
preferable.