Re: [TLS] matching identity, by default

Isn't "SHOULD" something like "There are some really good reasons for
us to recommend this, but we understand that there might be some
really good reasons to ignore it"?

I believe that "SHOULD" is the correct term for guidance to a
programmer as far as his software interfacing with the protocol.
"MUST" is the correct term for guidance to a programmer as far as the
protocol interfacing with the network, as far as bits-on-the-wire
goes.

I think Marsh's wording is about the best that can be applied.  I'd
probably end up with something like  "Sometimes processing this
application data within handshake is desired, but generally a TLS
implementation SHOULD discard any buffered plaintext before the
renegotiation's Finished messages UNLESS the renegotiation has the
same identity (as defined in [PKIX]).  TLS implementations SHOULD
expose the details of identity associated with each byte of
application data, though the details of such an API are beyond the
scope of this document."

-Kyle H

On Thu, Dec 3, 2009 at 4:29 PM, David-Sarah Hopwood
<david-sarah@jacaranda.org> wrote:
> Marsh Ray wrote:
>> * The TLS protocol allows application data to be interleaved within
>> rengotiation handshake messages. Sometimes this is desired, but may
>> require extra care. The application-supplied callback and TLS library
>> normally SHOULD discard any buffered plaintext at the point of
>> renegotiation.
>
> I appreciate the problem that this recommendation is trying to solve,
> but as stated here it may do more harm than good. Discarding any plaintext
> may cause the application protocol states at the client and server to
> lose synchronization, creating a vulnerability, or at least incorrect
> behaviour.
>
> --
> David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>
>