Re: [TLS] [CHANNEL-BINDING] New Problem (Was: Last Call: draft-altman-tls-channel-bindings)

[Nicolas Williams <[e-mail]>]

On Thu, Nov 05, 2009 at 12:03:41AM +0000, Larry Zhu wrote:
> I think this is good as is. The mentioned issue is in the TLS itself
> at which layer it knows every well what a TLS connection is so we do
> not have any confusions related to I mentioned.

I'm inclined to agree.  In fact, changing tls-unique would have zero
effect in an HTTPS context if authentication would likely be happening
before the server requests a re-negotiation, and if it happens after
re-negotiation then it's too late no matter what.

Therefore I see that we don't need to change tls-unique at all.

> Now some comments on the alternative proposals, I would prefer a
> stable identifier for the channel. If the name of the channel
> constantly changes when TLS renegotiates, it is a bad taste in the
> mouth for me.

tls-server-end-point channel bindings are that.  tls-unique is a unique
type of CB, which means it must be different every time.

We can't have any sort of non-unique channel binding for anonymous-
anonymous channels.  We can have them for anonymous-pseudonymous
channels, but we can't create those from where we stand.

Nico
--