Re: [TLS] Proposed text for removing renegotiation

[Martin Thomson <[e-mail]>]

On 27 May 2014 15:18, Salz, Rich <[e-mail]> wrote:
> I would rather see something like Yoav (?) proposed via Jabber at the interim meeting:  a "reset but don't close" message.  Either side sends it, the other side replies, and at this point all state is thrown away and it's just as if the client first connected.  It avoids TCP reconnect, perhaps requires more work (but the EDH key should be cached), but it seems much clearner.

If I understand you correctly, and I'm not sure, are you proposing
that we close the TLS connection, but not the TCP connection.  Is the
assumption that we have a 0RTT handshake that is piggybacked
immediately after a close alert so that application data can continue
to flow?

It's certainly clean, in the sense that you get a completely new
security context without some of the overhead.

But it seems a little heavyweight to me.  I'm also concerned about the
performance implications.  A 1RTT handshake would end up with dead air
on the client side if they initiate this, and even with 0RTT, the
server is always penalized if they initiate.  That is, unless we allow
for role inversion, which would make my head hurt.