Re: [TLS] Naming that TLS session/connection instance thing

[Michael D'Errico <[e-mail]>]

Nelson B Bolyard wrote:
> In a posting in another thread today, Marsh Ray wrote:
> 
>> Just keep in mind the many-to-many relationship between sessions and
>> connections. A connection may handle multiple sessions (generally at
>> different times) and a session may be on multiple connections
>> (simultaneously or separated in time). An instance of a session on a
>> connection is referred to as a "connection state".
> 
> It's also the thing to which a "TLS channel binding" binds, is it not?
> 
> Believing that it is, I propose that we name it a "TLS channel".
> 
> Does that proposal cause anyone here any great pain?

No pain, but I'd like some clarification.

I assume that if you make an initial connection to a server and perform
a full handshake, you have created a new, independent TLS channel.

But now if you make another TCP connection to the same server and resume
that session, has a new TLS channel been created?  Or is it the same one?

Also, let's say you just connected and performed a full handshake,
creating a new TLS channel.  If you then renegotiate with the server
using a full handshake, has a new TLS channel been created?  Or is it
the same?

If you connect, full handshake, and then renegotiate using an old session
(session resume), has a new TLS channel been created?  Does it depend on
whether the resumed session was the original session on this connection?
What if a session from an unrelated connection was resumed?

Thanks for any insight.

Mike