[TLS] Summarizing identity change discussion so far

[<[e-mail]>]

(wearing Area Director hat)

Although the IETF Last Call is still underway, here's a short attempt
to summarize the discussion regarding identity changes (Section 7) so
far:

- We seem to agree that changing the certificate/identity 
during secure renegotiation (so there's no man-in-the-middle, just two
parties) could confuse some applications.  James Manger's email provides 
IMHO a good example of what that confusion could be (in this particular 
example, the confusion has security implications, too):

http://www.ietf.org/mail-archive/web/tls/current/msg05122.html

- We mostly seem to agree that some applications could not just handle
certificate/identity changes correctly, but would actually benefit
from them. 

- We seem to agree that it would be a reasonable idea for the TLS
library to offer the applications an option where the TLS library
checks that the certificate doesn't change during renegotiation. 
This is an *option* -- an application could decide not to use it, 
and e.g. do more complex comparisons.

- We have much less support for requiring that every TLS library 
MUST implement this functionality and/or MUST enable it by default
(whatever "by default" means in your API), at least in this draft.

Unless I'm badly misreading the situation, or it significantly changes
during the rest of the IETF Last Call, my proposal here would be as
follows:

- We do NOT require (with "MUST") any changes to TLS libraries in this
regard.

- We describe the situation a bit more clearly than the current text
does (it seems many people found the current text somewhat unclear).

- We recommend that TLS libraries SHOULD provide identity matching
(with memcmp, abort handshake if changed) functionality to
applications, and SHOULD allow applications to enable/disable this
functionality.

- We include a sentence or two describing the pros and cons of
enabling/not enabling this feature by default, but don't require or
recommend any particular default value.

- The text probably needs to note that if the applications wants to
deal with identity changes, it may need to consider the "which
application_data byte(s) correspond to which identity" question (or it
may not -- the answer may depend a lot on the application protocol).

Does this sound like a reasonable approach?

Best regards,
Pasi