Re: [TLS] TLS process thread

[Eric Rescorla <[e-mail]>]

On Sun, Apr 13, 2014 at 10:44 PM, Watson Ladd <[e-mail]> wrote:

> On Sun, Apr 13, 2014 at 8:31 PM, Peter Gutmann
> <[e-mail]> wrote:
> > Sean Turner <[e-mail]> writes:
> >
> >>In this case, however, our charter provides a clear starting point,
> namely
> >>RFC 5246, and a mandate to minimize the changes to that document.
> >
> > If the charter really does require that then it sounds like it's high
> time to
> > update the charter...
>
> In particular, we need to make significant changes to the handshake to
> address insecure resumption,use a completely different record layer

because of Lucky13 (might as well make it AEAD, as Chacha20+Poly1305
> and AES-GCM do that, and whatever fixed up AES+hash people want to use
> can be shoehorned in),


The latter already exists in Section 6.2.3.3 of RFC 5246.

http://tools.ietf.org/html/rfc5246#section-6.2.3.3

All that's required is removing 6.2.3.1 and 6.2.3.2 which define block
and stream ciphers and merging any of the relevant text from those
into the AEAD section.



> renegotiation is probably going to die as no
> one needs it. (HTTP can use another header number to signal that you
> need a certificate, a reconnection is not the worse thing in the
> world, no one understands what renegotiation is supposed to do, and
> client certificate sensitivity can be fixed by not putting real names
> in them)
>

Also a simple matter of removing text, though I don't think it's clear
that we will actually be able to get away with this.

-Ekr