Re: [TLS] Pull Request: Removing the AEAD explicit IV

[Eric Rescorla <[e-mail]>]

On Thu, Mar 19, 2015 at 10:55 AM, Watson Ladd <[e-mail]> wrote:

>
> On Mar 19, 2015 10:40 AM, "Ilari Liusvaara" <[e-mail]>
> wrote:
> >
> > On Thu, Mar 19, 2015 at 09:20:54AM -0700, Watson Ladd wrote:
> > > On Thu, Mar 19, 2015 at 4:33 AM, Brian Smith <[e-mail]>
> wrote:
> > > > Watson Ladd <[e-mail]> wrote:
> > > >> If we're going to make a change this
> > > >> radical, why not make equally radical changes to simplify the
> protocol
> > > >> further if that's possible?
> > > >
> > > > That's already happening.
> > >
> > > No it's not: the draft is still longer than the TLS 1.2 RFC, and seems
> > > to demand support for every single usecase. This seems at odds with
> > > absolute simplification, where we would throw out less important
> > > features, and radically reduce the complexity.
> >
> > Got examples of features that could be removed or at least rendered
> > truly optional (besides things like 0RTT[1])?
>
> Update: most connections are short-lived.
>
At the interim we discussed having a simple re-key mechanism that
was less general than Update. I think we could have that but nothing
would also probably be fine.

Changing client auth state during a connection: restarting works fine.
>

Would that this were so. Unfortunately, there are existing HTTP-based
systems
which rely on this feature and will be fairly put out if we don't supply
it. That may
not be a totally dispositive argument, but re-starting is not really a
drop-in
replacement.

-Ekr