Re: [TLS] New cached-info draft 09 posted

[Marsh Ray <[e-mail]>]

On 07/12/2010 12:39 AM, Brian Smith wrote:
>
> There should be no problem with requiring TLS 1.2 as the minimum version for
> this extension, snap start, and false start. In fact, you could even require
> even a brand new TLS version for them at this point in time, and things
> would work out just fine.

Individually cached info, false start, and snap start seem like 
significant extensions. Since security is not generally composable, even 
if each extension is shown to be secure independently they should also 
be considered in combination. Perhaps it would be simpler 
administratively to bring them under a new TLS version number.

Taken together they seem to be a significant rework of the protocol, 
especially considering the changes to the Finished.verify_data message 
calculation. Snap start on its own is coming close to defining a new 
protocol that (for external reasons) happens to send a TLS-compatible 
Client Hello and runs on TCP port 443.

By loosening various constraints they give additional flexibility to an 
active attacker to modify the handshake, putting additional stress on 
the hash/MAC functions. It may be that verify_data needs lengthening, in 
which case a new protocol version number is probably indicated.

That said, they each have their independent merits and so it may not be 
fair to queue them all behind a new protocol version.

- Marsh