Re: [TLS] More clarity on resumption and session hash

[Ilari Liusvaara <[e-mail]>]

On Tue, May 26, 2015 at 08:17:15AM +0200, Karthikeyan Bhargavan wrote:
> On 26 May 2015, at 07:03, Martin Thomson <[e-mail]> wrote:
> 
> > On 25 May 2015 at 10:35, Eric Rescorla <[e-mail]> wrote:
> >> The two main options appear to be:
> >> 
> >>    1. Fall back to a full handshake.
> >>    2. Abort the connection
> >> 
> >> The argument for the first appears to be interop. The argument for the
> >> second appears to be that it's likely there is an error or a mid-flight
> >> reconfiguration on the client (which seems not good). My mild preference
> >> is for abort but I think it's important in any case that the draft be
> >> clear.
> > 
> > I'd prefer the second two.  That is, unless someone can come up with a
> > legitimate scenario where the former is needed.
> 
> The feedback we’ve been getting on the draft has been to try and preserve interoperability
> with legacy clients and servers (even more than the current draft.)
> Considering this goal, aborting seems harsh.

Also, there are two dangerous scenarios:
- You have non-session_hash session and resume that.
- You try to use TLS-Exporter in non-session_hase session for authentication.

Based on this, it would seem to be the safest to:
- Not offer any non-session_hash sessions for resumption.
- Deny resumption (full handshake) of any non-session_hash sessions, regardless
  of client session_hash support.
- Disable TLS-Exporter in non-session_hash sessions.


The following are odd edge cases (assuming both ends are due endpoints, these
are safe):
- Resume session_hash-enabled session wihout session_hash extension
- Resume session_hash-enabled session with non-session_hash server.


I was thinking latter of those odd behaviours could occur if one performs
rolling security fix of server farm:
- Client is security fixed
- Server A is security fixed
- Client connects to A
- Client gets session_hash-enabled session.
- Client connects to B, attempting to resume.
- Servers share session DB/key, so resumption succeeds.
- Client gets resumption without session_hash extension.


-Ilari