Re: [TLS] COMMENT: draft-ietf-tls-renegotiation

[Nicolas Williams <[e-mail]>]

On Tue, Dec 15, 2009 at 03:16:15PM -0800, Nelson Bolyard wrote:
> Peter Saint-Andre wrote:
> > I think the question Russ raised is: just how fundamental is TLS
> > renegotiation? And the answer so far seems to be: some deployments seem
> > to use it, but it might not be fundamental.
> 
> I believe it is very heavily used in business-to-business https transactions
> including so-called intranet transactions, where parts of a web site require
> different authentication than the rest.

Oddly enough, I found out today that an important OpenSolaris component
depends on it: the subscription-based software repository known as the
"extra" repo.  (The OpenSolaris IPS packaging system is layered above
HTTP.  The extra repo requires user authentication with certs in order
to obtain the contents of packages in that repository.

Not surprisingly this affects my stance on the issue.  Not because the
affected technology is my employers (or important to me) as much as
because it is a good example of how such applications might arise,
therefore an indicator that there may be many more like it.  It is
clearly simpler (well, for most TLS libraries, given their APIs) to fix
re-negotiation than to fix all such applications.

Nico
--