Re: [TLS] Resuming a session as part of a renegotiation.

I'd say that, over an existing connection, you'd mostly run an
abbreviated handshake resuming the current session to refresh keys.
You could also use it to reset sequence numbers, in case they're soon
going to overflow. I know no implementation doing that; all of them
seem to happily let the sequence number overflow, assuming the
connection will be tear down way sooner this happens (which is
probably true in most scenarios).

According to the spec, you could even run an abbreviated handshake
resuming a different connection form the current one. In a scenario
which I discourage (because it's asking for trouble confusing the
application), you could have a pool of established TLS sessions, each
using a different identity, and "swap" between them with abbreviated
re-handshakes over the same connection. Again, I'd take this as a
non-forbidden behavior, rather than a largely useful one.

On Thu, Sep 19, 2013 at 8:50 PM, Yoav Nir <ynir@checkpoint.com> wrote:
>
> On Sep 19, 2013, at 9:29 PM, Fabrice Gautier <fabrice.gautier@gmail.com> wrote:
>>> One possible use case: if you negotiated a block cipher with a
>>> small internal state and are sending large quantities of data,
>>> security might be improved by periodically renegotiating.
>>
>> Thats only benefit a full handshake renegotiation.
>>
>> The way I understand it, renegotiation allows you to have several
>> session in the same connection, and session resumption allows you to
>> have the same session across multiple connections.
>
> Renegotiation just means doing the handshake again. The end result is new keys. So if you believe that 3DES keys should not be used for more than 0.5GB of data, just doing a renegotiation gives you fresh keys (because they are mixed with the new nonces). If you resume the session, you don't get new client and/or server identities, you don't get re-authentication, and you don't get a new master key, so someone who has managed to get your old master key can figure out both your old and new encryption keys. But if the only reason you're renegotiating is that you need fresh keys, that's good enough.
>
> So renegotiation+resumption gives you the same session, but new keys. Sort of like "phase II" in IKE.
>
> Yoav
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls