Re: [TLS] draft-ietf-tls-cached-info-02 / New "Fast-Track" draft posted

[Michael D'Errico <[e-mail]>]

Adam Langley wrote:
> On Tue, Feb 2, 2010 at 3:50 AM, Brian Smith <[e-mail]> wrote:
> 
>> But, if the client already knows the certificate, then it
>> already knows the server's public key. Consequently, it is wasteful for the
>> client NOT to send the ClientKeyExchange along with the client hello.
> 
> Given a client-speaks-first protocol like HTTP (which I happen to be
> mostly concerned with), this could cut the full handshake from two to
> one round trips.
> 
> However, there's a much easier way of doing this: cut through mode. In
> this scheme the client starts sending application data records without
> waiting for the server's Finished message so long as the ciphersuite
> is sufficiently strong. Android already does this.

I'm not a cryptographer, but it seems to me that sending data over
the connection before it is validated is a very bad idea.  On my
test server, people have established connections in less than 40 ms
using a full handshake.  Most handshakes from around the world
complete in less than half a second.  Don't get too carried away
trying to optimize this, especially if you're not able to maintain
the security guarantees.

Mike