Re: [TLS] Proposed text for removing renegotiation

[Nikos Mavrogiannopoulos <[e-mail]>]

On Tue, 2014-06-17 at 16:56 -0400, Daniel Kahn Gillmor wrote:
> On 06/17/2014 03:36 AM, Nikos Mavrogiannopoulos wrote:
> > On Fri, 2014-06-13 at 08:34 -0300, Watson Ladd wrote:
> > 
> >> The issue is the following: most applications do something like this
> >> parse_request(conn)
> >> check_if_request_authorized(conn)
> >>
> >> This assumes that the authentication state doesn't change in between
> >> the two lines, or midway through the parse.
> >> With renegotiation it can.
> > 
> > Indeed, but this is an easily unsolvable issue. 
> Do you mean "easily solvable" here?

Yes.

> > That can be easily
> > avoided on the implementation side (and gnutls is does not allow that).
> > I have numerous times asked to clarify and better specify this part on
> > the past.
> Do you have a suggestion for how we could clarify and better specify
> this part?  Maybe it's worth crafting that into a counterproposal that
> could be weighed against the current "remove renegotiation" proposal.

My counter-proposal would be:
1. Removing the Note "If a rehandshake occurs while data is flowing on a
connection, the communicating parties may continue to send data using
the old CipherSpec."

2. Adding the text: "During the handshake process implementations SHALL
NOT allow application protocol data exchange. Implementations SHALL
terminate the session if application protocol data is received." (in
DTLS that data may arrive due to network errors so they should be
quietly discarded.

3. Adding the text "Since the authentication credentials may change
during a renegotiation the upper layers must be notified of either the
new negotiation process or any identity change."

That would make renegotiation a strictly inband process, and
applications would be able to distinguish traffic before and after a new
negotiation.

regards,
Nikos