[TLS] More clarity on resumption and session hash

[Eric Rescorla <[e-mail]>]

I'm updating the NSS session hash implementation to conform to the new spec
and I see that it's very clear on what happens when you have a resumption
where the original handshake did not include the extension and the new one
does (thanks David and Martin)

  o  If the original session did not use an extended master secret but
      the new ClientHello does contain the "extended_master_secret"
      extension, the server MUST NOT perform the abbreviated handshake.
      Instead, it SHOULD continue with a full handshake to negotiate a
      new session.

However, it's less clear on what happens when the original handshake
included
the extension and the new one does not:

   o  If the new ClientHello does not contain the
      "extended_master_secret" extension, the server SHOULD abort the
      handshake.  If it continues with an abbreviated handshake in order
      to interoperate with legacy peers, then the considerations in
      Section 5.4 apply.

This doesn't seem to distinguish between the two cases (original session
did and did not use the extension), but they seem different, since the
original session not using session hash is a common case (legacy) whereas
an extension->no extension transition is an anomaly. Note that the client
*is* required to send it, so I think there's a reasonably strong
argument that the server should require it.

The two main options appear to be:

    1. Fall back to a full handshake.
    2. Abort the connection

The argument for the first appears to be interop. The argument for the
second appears to be that it's likely there is an error or a mid-flight
reconfiguration on the client (which seems not good). My mild preference
is for abort but I think it's important in any case that the draft be
clear.


Similarly, the text about the client side doesn't seem to draw this
distinction:

      If the new ServerHello does not contain the
      "extended_master_secret" extension, the client SHOULD abort the
      handshake.  If it continues with an abbreviated handshake in order
      to interoperate with legacy peers, then the considerations in
      Section 5.4 apply.

Because above the server is required to provide the extension when
resuming a session where the extension was negotiated, it seems like
we should require the client to fail in that case (that's the sense
of the MUST).

I see there was some discussion on the list 3/10 but it was inconclusive.

-Ekr