Re: [TLS] Followup on Update

[Martin Thomson <[e-mail]>]

On 25 February 2015 at 15:00, Eric Rescorla <[e-mail]> wrote:
> As a minor nit, it's kind of a pain to say every M minutes because
> often TLS stacks are driven by the application and don't have internal
> timers, but you could of course say "first record after M minutes"
> which would (probably) be close enough.


In addition to this, it seems like more of a policy decision that is
driven more by circumstance than any direct security requirement.

We might recommend that rekeying occur for long sessions, but it's
hard to pick a one-size-fits-all value to recommend.  As low as 10
minutes might be appropriate for high-value, high-volume data; whereas
an IoT device with low-value, low-volume data might be content with
rekeying only for the purposes of session extension (i.e., on a scale
of days or weeks).

As proposed, there is no significant security benefit to the Update
protocol other than to stave off key exhaustion.  I think that's a
fine thing on its own merits, but I don't think we need to place too
much weight on the mechanism.