Re: [TLS] TLS renegotiation issue

[Nicolas Williams <[e-mail]>]

On Thu, Nov 05, 2009 at 11:23:26AM -0600, Marsh Ray wrote:
> I expect that EKR will be posting some details soon.

We await with bated breath :)

> Martin Rex wrote:
> >
> > Technically there is no
> > limit on the number of renegotiations, so a simple pointer
> > only one TLS session into the past does not seem sufficient
> > for that purpose.
> 
> I agree, the concept of "first handshake on the socket" is a bit
> nebulous from the perspective of the TLS spec.

Only at first glance.  The "first handshake", or, rather, "outer-most
handshake" is really one that occurs with null cipher spec, that is, not
under the protection of another TLS connection.

> The approach our proposal took was to work off of the "most recent
> previous finished message" over the underlying transport.

I recommend "the client finished, in cleartext, from the outer-most
handshake", with "first handshake" as described above.

Better yet, though equivalently, I recommend "the tls-unique channel
bindings of the outer-most handshake".  (Or at least state the
equivalence, and add a reference to draft-altman-tls-channel-bindings
and RFC5056.)

Nico
--